Executive Summary
MALFEX is an ongoing malicious npm campaign targeting Windows developers, linked to Portuguese-speaking operators. The campaign has evolved from using pure JavaScript loaders to employing compiled Node.js native addons (DLLs) to evade detection. The primary malicious package, `imgdecode`, utilizes a native Windows DLL to download encrypted shellcode from GitHub, which it then decrypts and injects into a suspended `dllhost.exe` process.
Once active, the loader delivers a multi-stage infection chain resulting in a Go-based downloader and a comprehensive 71.5 MB stealer and Remote Access Tool (RAT). This malware targets browser credentials, Discord tokens, cryptocurrency wallets, and gaming accounts. The actor has demonstrated sophistication by implementing anti-analysis checks, local event log tampering, and a conditional execution trigger that only activates when the package is run from an interactive terminal, thereby avoiding many automated sandboxes and CI/CD pipelines.
This campaign represents a significant risk to organizations with software development teams. The transition to native DLLs bypasses security controls that only monitor for malicious JavaScript install scripts. The urgency is high as the actor quickly republishes replacement packages when original ones are removed from the npm registry.