MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

A malicious npm package named 'imgdecode' is part of the MALFEX supply chain attack campaign targeting Windows systems. The package contains a compiled Node.js native addon that loads a malicious DLL, which downloads encrypted shellcode from a GitHub repository, decrypts it using a hardcoded key, and injects it into the dllhost.exe process. The campaign uses multiple interdependent packages and infrastructure, including GitHub repositories and a C2 server, to deliver payloads such as Overlord RAT and a Node.js stealer, while employing anti-analysis techniques and establishing persistence via registry and scheduled tasks.

AI-extracted · verify before operational use