SafeDep says imgdecode (1.0.0–1.0.3, publisher malfexteste8) loads a compiled Node addon on require(); from 1.0.1 the DLL downloads an AES-encrypted payload from GitHub repo cavecrew/proj and injects it into a suspended dllhost.exe, and only runs from an interactive Windows console, so CI and sandboxes don't trigger it. The operator republished replacements within days of npm takedowns after Checkmarx's Oct 5 report. A related chain fetches a 71.5 MB MALFEX stealer/RAT from 104.234.65[.]75:700. SafeDep says the package was still on npm as of Oct 13.