SafeDep reports that a malicious npm package named imgdecode, downloaded 979 times, conceals a loader within a compiled Node.js addon that executes a Windows dynamic-link library.
Linked to the long-running MALFEX supply chain campaign, the package exemplifies ongoing risks in package registry security.
According to researchers, “imgdecode” hides malicious code in a translated add-on that loads Windows system files. This action is part of a long-running software chain attack called MALFEX, which has been recorded by security companies and has been targeting Windows computers since August 6, 2023.
The evolution of the MALFEX campaign
As part of this campaign, the perpetrators have used various usernames to upload packages, such as “malfexkkj,” “malfex_user,” “malfexteste2,” “malfexteste3,” and “malfexteste4.” Some of the packages acted as remote control programs, while others worked together to execute a spyware program.
When platform administrators removed suspicious packages, the developers quickly released replacements, such as “runhelper,” “imgbundle,” and “imgdecode,” within two days. For example, older packages downloaded encrypted data from a GitHub repository, decrypted it with a specific key, and wrote an executable file to the computer’s storage. Other packages then ran that file and downloaded additional malware.
READ ALSO
Hackers broke into 173 companies with stolen key from well-known application
The latest version 1.0.3 of "imgdecode" removes the dependency on other packages and can run standalone. It uses a system file to fetch an image from the internet, decrypt the data, and inject it into a Windows core process.
How malicious software works
Before taking action, the program checks whether it is running in a virtual machine, in a secure testing environment, or if there are open network and system monitoring tools, in order to hide its activity.
If it does not detect such obstacles, it can collect sensitive data, such as:
- digital wallet recovery codes,
- password management files and security certificates,
- data from web browsers,
- information from communication applications such as Discord and Telegram,
- digital wallets and gaming applications.
It then connects to a remote server to accept commands, transfer files, and control processes. To remain on the computer even after a reboot, it adds entries to the system registry and creates a scheduled task called "MicrosoftEdgeUpdateService."
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
