---
title: MALFEX npm campaign moves its loader into a native Windows DLL ('imgdecode'), with no install script | ctxsec
url: https://ctxsec.com/items/malfex-imgdecode-native-addon
description: ""
status: "researcher report (SafeDep)"
published: 2026-10-17
---

> 

[← Cybersecurity News](/news) · [markdown](/items/malfex-imgdecode-native-addon.md)

researcher report (SafeDep)

2026-10-17

### MALFEX npm campaign moves its loader into a native Windows DLL ('imgdecode'), with no install script

SafeDep says imgdecode (1.0.0–1.0.3, publisher malfexteste8) loads a compiled Node addon on require(); from 1.0.1 the DLL downloads an AES-encrypted payload from GitHub repo cavecrew/proj and injects it into a suspended dllhost.exe, and only runs from an interactive Windows console, so CI and sandboxes don't trigger it. The operator republished replacements within days of npm takedowns after Checkmarx's Oct 5 report. A related chain fetches a 71.5 MB MALFEX stealer/RAT from 104.234.65[.]75:700. SafeDep says the package was still on npm as of Oct 13.

Sources: [SafeDep](https://safedep.io/malfex-imgdecode-npm-native-addon-loader/)