CERT24Code hidden in an image file in the npm package “imgdecode” launches malware targeting Windows computersLoading data…
CERT24Threat Observatory
Period

Code hidden in an image file in the npm package “imgdecode” launches malware targeting Windows computers

Researchers discovered the malicious npm package “imgdecode,” associated with the MALFEX software supply-chain campaign. The package hides a Windows DLL in a compiled Node.js addon that can retrieve encrypted shellcode from GitHub, decrypt it, and inject it into a new dllhost.exe process.

← Back to intelligence

Code hidden in an image file in the npm package “imgdecode” launches malware targeting Windows computers

Researchers discovered the malicious npm package “imgdecode,” associated with the MALFEX software supply-chain campaign. The package hides a Windows DLL in a compiled Node.js addon that can retrieve encrypted shellcode from GitHub, decrypt it, and inject it into a new dllhost.exe process.