Threat reportSupply ChainTL-2026-3799
MALFEX npm Campaign: 'imgdecode' Native Addon Hides DLL Shellcode Loader and Infostealer/RAT Chain
MALFEX npm Campaign (TL-2026-3799), also tracked as MALFEX, is a high-severity supply-chain compromise, first published 2026-10-17. It is attributed to MALFEX with low confidence, affects npm (Node.js ecosystem) imgdecode, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1MALFEX
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3799
- Threat ID
- TL-2026-3799
- Also known as
- MALFEX, MALFEX npm campaign, imgdecode malware, movinlike stealer, Overlord RAT loaders
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- MALFEX
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, finance, gaming
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in MALFEX npm Campaign
Malware and tooling: Rakhni
How MALFEX npm Campaign works
The long-running MALFEX operator published malicious npm packages, led by imgdecode (1.0.0-1.0.3), that ship a precompiled Windows .node addon which downloads an AES-encrypted payload from GitHub and injects it into dllhost.exe. The chain ends in a stealer/RAT that harvests browser, Discord, Telegram, crypto-wallet and gaming credentials and talks to a WebSocket C2 at 104.234.65.75:7007.
MALFEX is an npm supply-chain campaign that Checkmarx and CloudSEK link to a single operator who has published to the registry since August 2023 (campaign start cited as 2023-08-06). Checkmarx counts 12 packages tied to the operator: eight malicious and four benign cover packages (function-ascii, malfapi, malfex-webhook-node, centralizemiddle). Malicious packages are function-flag and function-color (postinstall downloaders; function-flag has been malicious since 2025-07-18 with roughly 37,000 lifetime downloads), cdn-img-fetch, img-to-native and native-runner (stealer chain), the Overlord RAT loaders tlxbnhd, tldriver and mxdriver, and the newer imgdecode, imgbundle and runhelper. Checkmarx recorded 40,767 lifetime downloads across the earlier malicious set as of 2026-10-01; imgdecode had 979 downloads at the time of The Hacker News report (2026-10-17). Publisher accounts are malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4 and (for imgdecode) malfexteste8. The operator signs the work: the shared key string 'malfexteam2027', README text crediting the 'Malfex team' (Portuguese-language, owner named 'Murizada'), and a GitHub account 'cavecrew' with commits at UTC-3.
imgdecode (published 2026-09-30, 1.0.3 on 2026-10-11) is a nine-line JavaScript file that loads a precompiled 64-bit MSVC DLL, imgdecode.node, with no binding.gyp or native source. Because the logic runs during N-API module initialization, no npm install script is needed; code executes on require(). SafeDep reports the DLL first calls GetStdHandle/GetConsoleMode and returns silently unless stdout is an interactive terminal, which skips CI/CD and automated sandboxes. It then fetches https://raw.githubusercontent.com/cavecrew/proj/main/banner.jpg (the URL is XOR 0x37-encoded in the DLL), treats the first 16 bytes as an IV, decrypts the rest with AES-256-CBC using the SHA-256 of the passphrase 'nif-runtime-2027', and injects the shellcode into dllhost.exe via VirtualAllocEx, WriteProcessMemory, VirtualProtectEx and CreateRemoteThread, falling back to in-process execution in node.exe if remote injection fails. In the earlier chain, cdn-img-fetch/img-to-native decode a PNG/JPG polyglot (key 'malfexteam2027'), with image-signature checks acting as a kill switch, and drop a Go downloader that retrieves the 'movinlike' stealer (setup.exe) from 104.234.65.75:700.
The stage-3 stealer audits for virtual machines, sandbox user accounts and analysis tools (x64dbg, procmon, Wireshark) before harvesting Chromium-browser passwords and cookies, Discord tokens (with client injection and webhook patching), Telegram Desktop tdata, crypto-wallet extensions and desktop wallets, gaming-platform sessions (Steam, Epic, Riot, Battle.net, Minecraft, Ubisoft), and files matching seed/mnemonic/wallet/secret/token/senha plus .kdbx, .pem, .ppk and .env. Data is zipped, split into 25 MB chunks and posted to a Discord webhook. It persists by copying itself to %APPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe and creating a Registry Run value and scheduled task both named MicrosoftEdgeUpdateService. It also connects to ws://104.234.65.75:7007/agent?license=... (embedded MALFEX license key, suggesting a malware-as-a-service model) for shell execution, file transfer, process control, clipboard access, screenshots and mouse/keyboard input. SafeDep further reports it edits Security and Sysmon EVTX logs (recalculating checksums) and deletes the PowerShell history file.
A parallel 'Arm A' delivers the Overlord Go RAT: a PNG from api.imghippo.com holding an IExpress cabinet, a signed AutoIt3.exe and an encrypted .a3x script, installed under %LOCALAPPDATA%\ScopeSmart Technologies Inc\ with a backdated scheduled task '\Maiden' running every five minutes. Overlord hollows TapiUnattend.exe under a spoofed explorer.exe parent and resolves C2 from encrypted Solana blockchain transaction memos; the analyzed build had no Solana address configured. Earlier function-flag versions fetched payloads (node.exe, svchost.exe, malfex.exe, nocry.exe) from Discord-CDN-style hosts and raw IPs. Sourcing caveat: the Hacker News article, Checkmarx, CloudSEK and SafeDep were read; no CVE or CVSS applies, and Checkmarx's MITRE list contains some questionable mappings that were not adopted. Overlord RAT C2 traffic was not observed by the analysts.
MITRE ATT&CK techniques used in TL-2026-3799
Collection
T1005 Data from Local System; T1056.001 Keylogging; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.003 Clear Command History; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.007 JavaScript; T1106 Native API
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Exfiltration
T1567 Exfiltration Over Web Service
Impact
defense-impairment
Affected products and versions in MALFEX npm Campaign
- npm (Node.js ecosystem) — imgdecode
Vulnerable versions: 1.0.0; 1.0.1; 1.0.2; 1.0.3 - npm (Node.js ecosystem) — cdn-img-fetch, img-to-native, native-runner, imgbundle, runhelper (stealer-chain packages)
Vulnerable versions: 1.0.0-1.0.3 (cdn-img-fetch, img-to-native, native-runner); 1.0.0 (imgbundle, runhelper) - npm (Node.js ecosystem) — function-flag, function-color (postinstall downloaders)
Vulnerable versions: function-flag 1.7.3, 2.3.5-2.3.9, 3.0.0, 4.0.0; function-color 1.0.0, 1.7.3 - npm (Node.js ecosystem) — tlxbnhd, tldriver, mxdriver (Overlord RAT loaders)
Vulnerable versions: tlxbnhd 0.0.1; tldriver 0.0.1; mxdriver 0.0.1, 0.0.2 - Microsoft — Windows (64-bit; payloads are Windows-only)
Vulnerable versions: Hosts that load the malicious packages
Remediation for MALFEX npm Campaign
Patches
- No vendor patch applies; npm removed native-runner, img-to-native, imgbundle and cdn-img-fetch, and runhelper was unpublished. imgdecode was still listed when the Hacker News article was published
Immediate actions
- Search package.json and lockfiles (package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock) for imgdecode, imgbundle, cdn-img-fetch, img-to-native, native-runner, runhelper, function-flag, function-color, tlxbnhd, tldriver and mxdriver, and remove any hits
- Block 104.234.65.75 (ports 80, 700 and 7007) and egress to raw.githubusercontent.com/cavecrew/ at the proxy/firewall
- On hosts that installed or required these packages, treat all browser-stored passwords, session cookies, Discord/Telegram sessions, crypto wallets and seed phrases, SSH/PEM keys and .env secrets as compromised; rotate and move funds to new wallets
- Hunt for node.exe spawning dllhost.exe without a /Processid: argument, and for the scheduled task and Run value named MicrosoftEdgeUpdateService and the \Maiden task
- Preserve Windows event logs off-host: the malware edits Security/Sysmon EVTX files and clears PowerShell history
Workarounds
- Run unvetted npm packages only in disposable isolated VMs without credentials
- Remove %APPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe, %APPDATA%\Microsoft\Windows\node_runtime_helper.exe, %APPDATA%\node.exe and %LOCALAPPDATA%\ScopeSmart Technologies Inc\ after confirming infection and rebuild affected hosts
Longer-term hardening
- Enforce an npm package allow-list or internal registry proxy with a minimum package-age policy
- Flag precompiled .node binaries that have no binding.gyp or native source, and native addons importing WinINet/bcrypt without matching functionality
- Forward logs to a central collector in real time so local log tampering cannot erase evidence
- Use EDR rules for process injection into dllhost.exe from node.exe
- Run npm install with --ignore-scripts in CI and review require()-time behavior of native modules
Weaknesses (CWE) in MALFEX npm Campaign
Timeline of MALFEX npm Campaign
- MALFEX operator begins publishing to npm (initially benign packages), per The Hacker News and Checkmarx
- function-flag turns malicious with a postinstall downloader; it stayed without an advisory for about 14 months
- OSV advisories begin appearing for some MALFEX packages (22-30 September per Checkmarx); coverage of function-flag, function-color and cdn-img-fetch 1.0.2-1.0.3 stays incomplete
- cdn-img-fetch, img-to-native and native-runner 1.0.0 published; the movinlike Discord exfiltration webhook is created the same day
- npm removes native-runner and img-to-native
- imgbundle, runhelper (unpublished same day) and imgdecode 1.0.0 published as replacements for the removed chain
- Checkmarx publishes MALFEX analysis: 40,767 lifetime downloads across the earlier malicious packages; function-flag, function-color and cdn-img-fetch still installable
- npm removes imgbundle
- npm removes cdn-img-fetch
- imgdecode 1.0.3 published, consolidating all stages into one package
- SafeDep observes the payload server still operational
- The Hacker News reports imgdecode at 979 downloads, attributing analysis to SafeDep, Checkmarx and CloudSEK
Sources cited for MALFEX npm Campaign
- MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
- SafeDep: MALFEX imgdecode npm native addon loader
- Checkmarx: malfex npm malware campaign - three payloads and an adversary that signs their work
- CloudSEK: MALFEX malicious npm postinstall supply chain campaign
- MALFEX npm Campaign: 8 Packages Trigger Malware on Install and Require
- MALFEX - A malicious npm postinstall no advisory has caught for fourteen months
Detection coverage for TL-2026-3799
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3799 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.