iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
imgdecode is a malicious MALFEX npm package, not a normal image decoder. SafeDep reported on October 13, 2026 that requiring the package can load a prebuilt Windows N-API addon whose initialization downloads encrypted content, decrypts it, and injects it into a suspended dllhost.exe process. The observed trigger is an interactive Windows console, so blocking npm install scripts does not stop this module-load path.
What imgdecode does
The package’s JavaScript entry point loads prebuilds/win32-x64/imgdecode.node. That file is a compiled 64-bit MSVC DLL built with node-addon-api; SafeDep observed a PDB path ending in build\Release\imgdecode.pdb. The addon exports napi_register_module_v1, and its initialization routine runs the loader before returning the module’s exports.
On the analyzed Windows path, the loader requests hxxps://raw.githubusercontent[.]com/cavecrew/proj/main/banner.jpg, decrypts the returned data with AES-256-CBC, and injects the result into a suspended dllhost.exe process. SafeDep did not recover banner.jpg, so the exact final payload has not been confirmed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Does requiring the package execute malware?
It can. The malicious routine is inside native-module initialization rather than an npm install hook. When a Node.js program executes require('imgdecode'), Node loads the .node DLL. The observed loader then proceeds only when standard output is an interactive Windows console.
- Interactive Windows console: this is the condition under which SafeDep observed the download, decryption and injection path.
- Redirected output: redirecting standard output can prevent the observed path from triggering, but that is not a security guarantee.
- Install-script controls: disabling npm lifecycle scripts does not prevent code that runs when the package is later required.
The analysis covers a Windows native addon. Do not treat a non-triggering test on another operating system, or a test with redirected output, as proof that a workstation is clean.
#1 Best Overall
Version timeline
| Version | Publication timing | Observed detail |
|---|---|---|
1.0.0 |
September 30, 2026 | First version in SafeDep’s analyzed replacement sequence. |
1.0.1 |
Later on September 30, 2026 | SafeDep identified the fetch, decryption and execution behavior beginning with this version. |
1.0.2 |
October 1, 2026 | Contained the analyzed native-loader design. |
1.0.3 |
October 11, 2026 | Removed the earlier imgbundle dependency while retaining the native loader. |
SafeDep recorded 929 downloads of imgdecode between September 30 and October 12, 2026. A download is a registry event, not proof that a computer installed or executed the package.
How the native loader works
- A JavaScript application calls
require('imgdecode'). - Node resolves and loads
prebuilds/win32-x64/imgdecode.node. - The DLL’s
napi_register_module_v1initialization routine runs before normal exports are returned. - On an interactive Windows console, the addon contacts the GitHub raw-content endpoint shown above.
- The downloaded bytes are decrypted with AES-256-CBC.
- The decrypted content is written into a suspended
dllhost.exeprocess for execution.
The combination is significant: a package can hide its behavior in a prebuilt binary, avoid an install script entirely, and use a familiar Windows process as the injection target.
What is known about the final payload
The exact contents of banner.jpg were not recovered in SafeDep’s analysis. A related banner.png sample delivered a Go downloader for a 71.5 MB MALFEX stealer/RAT executable, but connecting that sample to banner.jpg is an inference, not an identification. The confirmed finding is the loader chain, not the identity of the final program.
Indicators defenders should investigate
SafeDep’s combined indicators are more useful than any single file or string:
- A package contains a DLL under
prebuilds/but provides no native source orbinding.gyp. - The native addon imports WinINet or WinHTTP and
bcrypt.dllwithout showing credible image-codec behavior. node.exespawnsdllhost.exewithout a/Processid:argument.node.execonnects toraw.githubusercontent.com, followed bydllhost.execonnecting to an unknown host.
Review process creation, command-line, DNS, proxy and network-flow telemetry around the time a project loaded the dependency. Also inspect package contents and the lockfile rather than relying only on the package name.
Rank #3
Was a Windows developer machine compromised?
If the machine loaded imgdecode, treat it as potentially compromised. The conditional console trigger means an absence of obvious symptoms does not clear the host.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Isolate the workstation. Remove it from normal network access while preserving volatile and forensic evidence according to your incident-response procedures.
- Preserve evidence. Save the project directory, lockfiles, npm cache entries, package tarballs, shell history, endpoint telemetry and relevant network logs before cleaning the system.
- Rotate credentials from a clean system. Prioritize tokens, SSH keys, cloud credentials and developer-service secrets that were available to the affected workstation.
- Review dependency scope. Search every lockfile, workspace and npm cache for
imgdecodeand related MALFEX packages, including transitive paths. - Hunt for the process and network indicators. Look for the unusual
node.exetodllhost.exerelationship and the GitHub raw-content connection described above. - Rebuild or reimage according to your security team’s decision. Do not assume deleting the package alone removes injected or downloaded components.
Campaign context and advisory coverage
Checkmarx described MALFEX as an apparent single-operator npm campaign active since August 2023. By October 1, 2026, it attributed 40,767 recorded downloads to eight malicious packages; function-flag accounted for 37,419. These figures measure registry downloads, not confirmed infections.
Advisory coverage is incomplete for related packages. OSV’s MAL-2026-17320 covers cdn-img-fetch, while later replacement packages require direct package, lockfile and telemetry review. The absence of an advisory entry should not be treated as evidence that a package is safe.
Why imgdecode is distinctive among MALFEX packages
- Trigger: module loading, rather than an npm install hook.
- Payload role: a native loader that fetches and injects encrypted content.
- Operating-system scope: the analyzed path uses a Windows x64 native addon.
- Detection challenge: prebuilt native code can conceal behavior that is absent from the short JavaScript entry point.
- Advisory status: coverage varies across related packages, so package-level and lockfile-level checks remain necessary.
What developers should change now
- Pin and review dependency versions instead of accepting replacement releases automatically.
- Require source and build provenance for native addons; scrutinize prebuilt DLLs without corresponding native source.
- Use endpoint rules that alert on unusual child processes from
node.exe, especiallydllhost.exe. - Monitor developer workstations for unexpected outbound connections from Node.js to raw-content hosting services.
- Keep npm caches and lockfiles available for investigation rather than deleting them during routine cleanup.
The central lesson is that install-script blocking is only one control. A package can execute during module initialization after installation, and a compiled addon can carry the downloader and injection logic outside the visible JavaScript.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
