Date: October 17, 2026 | Author: Threat Research & Intelligence Team, Digital Spying
Category: Software Supply Chain / Malware Analysis / npm Security / Reverse Engineering / DevSecOps
Tags: MALFEX, imgdecode, npm, Node.js Native Addon, C++, DLL Injection, dllhost.exe, Shellcode Loader, Overlord RAT, Supply Chain Attack
Executive Summary
The open-source software supply chain has encountered a sophisticated architectural evolution designed to render traditional dependency scanners obsolete. On October 16–17, 2026, cybersecurity threat research firms SafeDep and Checkmarx published in-depth reverse-engineering analyses uncovering a new weaponized package in the long-running MALFEX supply chain campaign.
As reported by SafeDep, The Hacker News, and SOC Prime, the threat actors uploaded a malicious package named imgdecode to the official npm registry, masquerading as a legitimate utility for image decoding.
Unlike traditional npm malware that relies on obfuscated JavaScript files, suspicious shell scripts, or pre-install hooks that trigger static Abstract Syntax Tree (AST) analyzers, imgdecode shifts its entire exploitation logic into a pre-compiled Node.js native C++ addon (.node / Windows Dynamic Link Library / DLL). When imported into a developer's application or CI/CD build pipeline on Windows, the native binary executes in memory, downloads encrypted shellcode from GitHub, decrypts the payload in RAM, and injects it into a newly spawned dllhost.exe (COM Surrogate) process to deploy the modular Overlord RAT.
Technical Deep-Dive: Deconstructing the MALFEX Native Addon Exploit Chain
To understand how compiled native addons circumvent software supply chain defenses, we dissect the Node-API architecture, the deceptive JavaScript wrapper, and the process injection pipeline.
Execution Stage
Component / Entity
Technical Action & Mechanism
1. Package Installation
Developer Machine / CI/CD
Executes npm install imgdecode and imports via require('imgdecode').
2. Native Binary Load
Node.js Runtime (node.exe)
Invokes build/Release/imgdecode.node. Underlying Windows DLL is loaded via LoadLibrary (bypassing AST scanners).
3. C2 Payload Fetch
Network Layer (WinHTTP)
Establishes outbound HTTPS connection to raw.githubusercontent.com C2 repository.
4. In-Memory Decryption
Process Heap
Decrypts XOR/AES obfuscated shellcode directly in RAM with zero disk artifacts.
5. Process Spawning
Target OS Subsystem
Calls CreateProcessW to launch a legitimate system binary: C:\Windows\System32\dllhost.exe.
6. Memory Injection
dllhost.exe Context
Allocates memory via VirtualAllocEx, writes payload, and redirects execution via QueueUserAPC.
7. RAT Deployment
Overlord RAT
Executes inside dllhost.exe, exfiltrates credentials, and opens a persistent back-connect tunnel.
1. The Node.js Native Addon Architecture: Why Static Scanners Fail
The core innovation of the imgdecode attack lies in its exploitation of Node.js’s native extension interface:
* Node-API (N-API): Node.js allows performance-critical modules to be implemented in C or C++ rather than JavaScript. These native addons compile into architecture-specific binary files ending in .node, which are standard shared libraries (Dynamic Link Libraries / DLLs on Windows).
* The Scanner Blind Spot: Modern software supply chain security platforms (such as npm audit, Socket, Snyk, and Phylum) primarily parse and analyze JavaScript, TypeScript, and JSON files using Abstract Syntax Tree (AST) analysis. They search for suspicious API calls like eval(), child_process.exec(), or base64 string decoding. When a package delegates its execution to a compiled binary .node file, static JavaScript analyzers perceive an empty, clean package and pass it as benign.
2. The Deceptive JavaScript Wrapper (index.js)
The entry point of imgdecode contained only nine lines of clean, unminified JavaScript:const path = require('path');
const addon = require('./build/Release/imgdecode.node');
function decodeImage(buffer) {
return addon.decode(buffer);
}
module.exports = { decodeImage };
// Initializer triggered on import
addon.initialize();
To a code reviewer or automated linter, this structure appears to be a standard wrapper for an image processing library. However, the moment require('imgdecode') is called, the Node.js runtime invokes the Windows API LoadLibrary to map imgdecode.node into process memory, transferring execution immediately to the compiled C++ initialize() function.
3. The Native Exploit Sequence: C2 Fetch and dllhost.exe Injection
Once inside native code, the malware executes a stealthy multi-stage loader:
* Step 1: Network Ingress via GitHub: The C++ addon utilizes native Windows networking APIs (WinHttpOpen, WinHttpConnect) to establish an encrypted HTTPS connection to an attacker-controlled GitHub repository (raw.githubusercontent.com/malfexteste8/...).
* Step 2: In-Memory Decryption: The downloaded payload is a heavily obfuscated byte array. The native binary decrypts the payload entirely in heap memory using an embedded cryptographic routine, ensuring that raw shellcode signatures never touch physical disk storage.
* Step 3: Process Injection into dllhost.exe:
* To disguise its long-term presence, the addon does not execute the malicious payload within the node.exe process (which might terminate when a script finishes).
* Instead, it invokes CreateProcessW to spawn a new instance of dllhost.exe (the legitimate Windows COM Surrogate process) in a suspended state.
* Using VirtualAllocEx and WriteProcessMemory, the loader injects the decrypted shellcode into the memory space of dllhost.exe.
* It redirects the execution thread using QueueUserAPC or ResumeThread, allowing the shellcode to execute under the camouflage of a standard Microsoft operating system binary.
* Step 4: Overlord RAT Execution: The injected shellcode unpacks the Overlord RAT, an evasive, Golang-based remote access trojan linked to the MALFEX campaign. The RAT establishes persistent command-and-control communication, exfiltrates developer browser credentials and cryptocurrency wallets, and grants operators interactive shell access to the host workstation.
Industry Impact on DevSecOps and Dependency Governance
The emergence of native binary loaders in the npm registry represents a critical escalation for software engineering organizations:
* The Collapse of Text-Based Package Auditing: Organizations that rely solely on static source-code analysis for third-party dependencies are blind to threats hidden within compiled native modules.
* Developer Workstations as Ingress Gates: Software engineers frequently install experimental packages locally for testing. A developer running npm install on a Windows workstation unwittingly grants native arbitrary code execution to threat actors, turning their laptop into a lateral pivot into corporate cloud environments.
Defensive Hardening Blueprint & Remediation Strategies
To defend enterprise development environments and CI/CD pipelines against native supply chain malware, security leaders must enforce the following controls:
1. Enforce Native Addon Detection and Policy Constraints
* Configure CI/CD pipelines and package managers to alert on or restrict dependencies containing pre-compiled binary artifacts (.node, .dll, .so, .dylib).
* Require that any package utilizing native addons must be compiled from verified source code locally via node-gyp, rather than shipping pre-compiled vendor binaries.
2. Restrict Package Manager Network Egress & Permissions
* Run Builds in Isolated Containers: Execute all npm install, testing, and build processes inside sandboxed, ephemeral containers (e.g., Docker, Dev Containers) that drop all administrative capabilities.
* Block Outbound Egress During Builds: Restrict network access during dependency installation phases strictly to verified package registries (e.g., corporate private npm proxies), preventing build scripts from contacting external GitHub repositories or unknown C2 domains.
3. Endpoint Threat Hunting & Process Anomaly Rules
Configure EDR detection rules (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne) to monitor Node.js process behavior:
* Anomalous Process Lineage: Flag any occurrence where node.exe spawns standard system processes like dllhost.exe, cmd.exe, powershell.exe, or rundll32.exe.
* Memory Injection Detection: Detect cross-process memory allocations and thread hijacking originating from node.exe targeting host operating system binaries.
* WinHTTP Network Connections: Alert on developer workstation processes initiating outbound connections to raw code-hosting repositories from non-browser binaries.
________________
For software supply chain teardowns, reverse engineering analyses, and DevSecOps defense blueprints, subscribe to Digital Spying.