MALFEX: The Campaign That Outlives Takedowns
Every MALFEX takedown buys about two days before the operator republishes. Block behaviour, not package names; the runbook follows.
MALFEX: The npm Campaign That Outlives Its Takedowns
MALFEX has published malicious npm packages since August 2023, and no removal has slowed it down. When npm pulled native-runner, the operator shipped runhelper within two days. Six hours after another unpublish, imgdecode appeared with a compiled DLL that injects shellcode into dllhost.exe, and it was still on the registry when The Hacker News reported it on 17 October. This is a campaign you contain by behaviour, not by name.
What MALFEX ships, and to whom
Checkmarx and CloudSEK first documented the campaign: eight packages across five handles, including malfexkkj, malfex_user and malfexteste2 through malfexteste4, plus malfexteste8 later. Three act as loaders for Overlord RAT. Three others, cdn-img-fetch, img-to-native and native-runner, chain into movinlike, a 64 MB Node.js stealer packaged as a Windows executable. gbhackers, citing the Checkmarx analysis, adds four more packages that carried no malicious code and served as cover.
The payloads aim at Windows. The stealer targets eight Discord clients, browser cookies and saved passwords, Telegram Desktop sessions, and wallets including MetaMask, Phantom and Coinbase Wallet. Obfuscated preinstall and postinstall scripts retrieve a Windows executable from an image hosting service. It arrives as an IExpress archive holding a legitimately signed AutoIt interpreter and an encrypted script. XOR, RC4 and LZNT1 stages later, Overlord RAT runs hollowed into TapiUnattend.exe with explorer.exe spoofed as parent, though researchers did not observe that injection at runtime. Persistence is a scheduled task named Maiden, running every five minutes from a fake vendor directory.
imgdecode: nine lines that load a DLL
imgdecode landed on 30 September 2026, uploaded by malfexteste8. SafeDep's analysis, quoted by THN, describes a nine-line JavaScript entry that loads a compiled Node.js addon. Call require('imgdecode') from a Windows console and the DLL downloads encrypted shellcode from GitHub, decrypts the response, and injects it into a fresh dllhost.exe process. Version 1.0.1 onward lets the DLL fetch and decrypt on its own, and version 1.0.3 drops the imgbundle dependency entirely, so one package now completes the chain. It had 979 downloads at writing time and remained available on npm.
The stego trick is older than imgdecode. cdn-img-fetch pulls banner.png from the GitHub repository cavecrew/proj; an encrypted blob rides after the image data; img-to-native decrypts it with the key malfexteam2027 and writes a Go executable to %APPDATA%\Microsoft\Windows\node_runtime_helper.exe.
The two-day replenishment cycle
The operator watches disclosures and restocks. THN's timeline: replacements for native-runner and img-to-native appeared within two days of removal, as runhelper and imgbundle, and the first imgdecode version published the same day. Six hours after runhelper was unpublished, imgdecode arrived with its compiled DLL. Three years, one playbook, no worm.
That contrast matters if you read our ChainDrop coverage. In our ChainDrop runbook the threat automates everything: stolen tokens, self-republishing, a watcher that punishes revocation. MALFEX has none of that machinery. A human restocks the shelves by hand. It spreads slower, and it survives the single takedown that ends an automated campaign.
Why name-based blocking loses
The malicious packages collected 40,767 downloads by 1 October 2026, including 3,017 in the preceding week, per the Checkmarx numbers gbhackers cites. A name blocklist arrives two days late, permanently. The operator holds at least six handles, eight malicious packages, and cover packages that train scanners to see the account as clean.
The behaviour, meanwhile, never changes: preinstall and postinstall execution, network access at require time, image-hosted payloads, PNG files with appended blobs, and process injection into dllhost.exe. Those survive every rename. Git-side seams behave the same way, which is why our gitspawn breakdown also argues from mechanics rather than indicators.
The containment runbook
- Set ignore-scripts true across the org and re-enable per package only after review, because MALFEX enters through preinstall and postinstall hooks.
- Allowlist egress from developer machines and CI runners, so the DLL's shellcode fetch from GitHub and the banner.png pull from cavecrew/proj become failed connections instead of infections.
- Alert on behaviour: network I/O at require time from native addons, node spawning dllhost.exe, and scheduled tasks matching the Maiden pattern of a five-minute interval inside a vendor-looking directory.
- Sweep the fleet for IOCs: the malfexteam2027 key, node_runtime_helper.exe paths, PNGs with appended data, and IExpress archives containing AutoIt interpreters.
- Watch handles, not packages: anything published by the malfex accounts, plus fresh accounts shipping compiled addons behind nine-line entry points.
- Treat every takedown as intel, not clearance. Expect a replacement within two days and re-run steps 3 to 5. Our untrusted code guide assumes the same posture for every install, and teams that isolate each workload shrink the blast radius when a name slips through.
Verdict, and the caveats on this page
Our verdict: MALFEX proves takedowns are not containment. The operator treats npm removals as inventory loss and restocks within days, so the durable controls are behavioural: script policy, egress allowlists, and injection alerts that outlive every rename.
- MALFEX payloads are Windows executables; in our Linux microVM fleet the direct blast radius stops at developer workstations and Windows CI runners, which is a limitation of scope, not immunity.
- imgdecode was still listed when THN published on 17 October, and that snapshot does not stay true for long; verify the registry before treating any version list here as current.
- This page covers MALFEX only, however the behavioural steps do not transfer cleanly to worm campaigns such as ChainDrop or Shai-Hulud, which add token theft and self-propagation.
- Attribution is behavioural, not legal: Checkmarx, CloudSEK and SafeDep link the packages to one operator by pattern, and attribution cannot reach identity, since no public source names the operator.
FAQ
Is MALFEX still active?
As of the latest reporting, yes. THN published its imgdecode analysis on 17 October 2026 with the package still available on npm and 979 downloads recorded. The campaign has published since August 2023 across at least six handles, and every removal so far has been followed by a replacement.
How is MALFEX different from Shai-Hulud or ChainDrop?
No worm. Shai-Hulud and ChainDrop automate propagation with stolen npm tokens and republish poisoned packages by themselves. MALFEX is one operator restocking Windows-targeted loaders and stealers by hand. It spreads slower, waits longer, and shrugs off the takedowns that end automated campaigns.
Should I block the MALFEX package names?
Block them, then stop relying on them. Names rotate within days: native-runner became runhelper, img-to-native became imgbundle. The controls that persist are ignore-scripts, egress allowlists, and alerts on DLL loads and process injection, because those survive every rename the operator can invent.
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "BlogPosting",
"headline": "MALFEX: The npm Campaign That Outlives Its Takedowns",
"datePublished": "2026-10-19",
"dateModified": "2026-10-19",
"author": {"@type": "Organization", "name": "Krova Cloud Engineering"},
"publisher": {"@type": "Organization", "name": "Krova Cloud"},
"mainEntityOfPage": "https://krova.cloud/blog/malfex-npm-campaign-outlives-takedowns"
},
{
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Is MALFEX still active?",
"acceptedAnswer": {"@type": "Answer", "text": "As of the latest reporting, yes. THN published its imgdecode analysis on 17 October 2026 with the package still available on npm and 979 downloads recorded. The campaign has published since August 2023 across at least six handles, and every removal so far has been followed by a replacement."}
},
{
"@type": "Question",
"name": "How is MALFEX different from Shai-Hulud or ChainDrop?",
"acceptedAnswer": {"@type": "Answer", "text": "No worm. Shai-Hulud and ChainDrop automate propagation with stolen npm tokens and republish poisoned packages by themselves. MALFEX is one operator restocking Windows-targeted loaders and stealers by hand. It spreads slower, waits longer, and shrugs off the takedowns that end automated campaigns."}
},
{
"@type": "Question",
"name": "Should I block the MALFEX package names?",
"acceptedAnswer": {"@type": "Answer", "text": "Block them, then stop relying on them. Names rotate within days: native-runner became runhelper, img-to-native became imgbundle. The controls that persist are ignore-scripts, egress allowlists, and alerts on DLL loads and process injection, because those survive every rename the operator can invent."}
}
]
}
]
}
