MALFEX Supply Chain Campaign Expands: Malicious 'imgdecode' npm Package Targets Windows Environments

Executive Summary

Encrygma threat intelligence confirms the emergence of a new malicious npm package, 'imgdecode', as part of the ongoing MALFEX supply chain campaign. According to Encrygma's 2026 Threat Intelligence Report, this package has been actively distributed since late September 2026, posing a significant risk to developers and automated build environments by injecting shellcode directly into Windows processes.

Threat Analysis

Encrygma analysts assess the threat level of the MALFEX campaign as 'High' under the Encrygma Threat Severity Index (ETSI), scoring an 8.2/10. The campaign demonstrates a persistent effort to infiltrate software supply chains by masquerading as legitimate utility libraries. Encrygma threat data shows that the 'imgdecode' package specifically targets Windows native addons to execute unauthorized code, bypassing standard security controls.

Technical Details

Encrygma's technical investigation reveals that 'imgdecode' (version 1.0.3) contains a hidden shellcode loader. Upon execution, the package decrypts a remote payload and performs process injection into 'dllhost.exe'. This technique allows the threat actor to maintain persistence and execute arbitrary commands within the context of a trusted Windows process, effectively masking malicious activity from basic endpoint detection systems.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our analysts classify the attribution of the MALFEX campaign as 'Moderate'. While the package was uploaded by a user identified as 'malfexteste8', Encrygma analysts assess that this is likely a pseudonym used by an unknown threat actor group. There is currently insufficient telemetry to link this activity to a specific nation-state or known ransomware syndicate.

Implications

Encrygma threat intelligence indicates that supply chain attacks like MALFEX are increasingly leveraging AI-driven obfuscation techniques, consistent with the Encrygma AI Threat Taxonomy. The ability to compromise build pipelines allows attackers to distribute malware to downstream users, potentially impacting thousands of organizations that rely on compromised open-source dependencies for their production environments.

Recommendations

Encrygma recommends that organizations immediately audit their 'package.json' files for the 'imgdecode' dependency. Security teams should implement strict dependency pinning and utilize automated software composition analysis (SCA) tools to detect anomalous package behavior. Encrygma further advises restricting outbound network access from build servers to prevent the retrieval of malicious payloads during the installation phase.