Malicious npm Package imgdecode Infects Over 40,000 Developers
Security experts have uncovered a harmful npm package named imgdecode that conceals malware within image files, impacting more than 40,000 developers globally. The discovery, made by SafeDep researchers, reveals that the package is part of a broader attack campaign leveraging multiple npm libraries to distribute malicious code.
Details of the imgdecode Malware and Its Operation
The imgdecode package contains a compact JavaScript file that loads a Windows DLL. This DLL then downloads an encrypted payload masquerading as a JPEG file from a GitHub repository. After decryption, the payload injects malicious shellcode into the system’s dllhost.exe process, allowing it to operate stealthily and bypass conventional security monitoring.
Notably, the malware checks if the decrypted content corresponds to an actual image file, such as JPEG or PNG, in which case it halts execution to evade detection. This technique enables the attackers to disable the loader by supplying encrypted content that decrypts into image data.
Scope and Timeline of the MALFEX Campaign
The imgdecode package is among eight malicious npm packages linked to the MALFEX campaign, which has been targeting Windows developers since August 2023. Collectively, these packages have been downloaded over 40,000 times, with the majority attributed to another package called function-flag, which accounts for more than 37,000 downloads.
The malicious packages have been found appearing and disappearing on npm, as operators quickly substitute removed packages with new ones to maintain the campaign. For instance, after npm removed certain packages like native-runner and img-to-native, replacements such as runhelper and imgbundle were published shortly thereafter, showcasing the attackers’ persistence.
Malware Impact and Recommendations for Pakistani Developers
The campaign installs two key malicious programs. One is a Node.js stealer named movinlike that extracts sensitive information from browsers like Chromium and Telegram, as well as cryptocurrency wallets. It also targets critical files and private keys. The second is the Overlord RAT, a remote access tool that enables hackers to control infected machines remotely.
System persistence is achieved via changes to the Windows Registry and scheduled tasks. Given the stealthy nature of the malware, affected Windows devices might remain compromised unnoticed. Security experts advise anyone who has installed these contaminated packages to consider their systems compromised and immediately rotate passwords and transfer cryptocurrency funds to secure wallets.
This revelation holds significant consequences for Pakistani developers and tech firms relying on npm repositories. Since npm packages are widely used in software development, this malware could threaten the integrity of software production and the security of sensitive data across the Pakistani IT industry. Heightened vigilance, timely updates, and adherence to cybersecurity best practices are crucial to mitigate the risks posed by such supply chain attacks.
As Abdul Wasay from SafeDep highlighted, the continuous publication of replacement malicious packages underscores the ongoing challenge of securing open-source supply chains against persistent threats.
