Poisoned Pipeline

Poisoned Pipeline / Incidents / AS297

AS297 · 2026-09

MALFEX npm campaign, including a native imgdecode loader with no install script

npmWindows softwareGit / GitHubDeveloper workstation

CloudSEK (30 Sep 2026) documented MALFEX, one operator's npm campaign
running from August 2023 through September 2026: at least twelve
packages plus a GitHub payload repo (cavecrew/proj). Five packages
carry Amazon Inspector MAL- advisories, three are malicious and were
still unadvised, and four are benign cover tools. The live unadvised
set is function-flag (malicious postinstall since 18 July 2025; the
latest tag points at 1.7.3, a lower number than earlier builds),
cdn-img-fetch (still installable after npm seized its parent
img-to-native), and function-color (a wrapper whose only job is to
depend on function-flag).

Arm A (tlxbnhd, tldriver, mxdriver; MAL-2026-16383, -16384, -16385;
unpublished) used install scripts to fetch a Windows PE served with
an image/png content type. The file is an IExpress cabinet holding a
legitimately signed AutoIt3 interpreter and an encrypted script, then
a build of the overlord-client Go RAT whose Solana-memo C2 strings
are live. Arm B pulls a PNG polyglot from the operator's GitHub repo,
decrypts it with the team-name constant malfexteam2027, and stages a
Node.js stealer (movinlike) that injects into Discord clients,
harvests browser data and Telegram tdata, and exfiltrates to a
Discord webhook. CloudSEK did not observe a confirmed downstream
victim compromise; the report is operator reach, including packages
still installable on 29 September 2026. macOS and Linux launch paths
are present in the install scripts, but the fetched payload is a
Windows PE and those paths produce no second stage. Checkmarx Zero (5
Oct 2026) documented the same operator. The title phrase about signing
their work is branding: publisher handles, git author
corpmalfex@gmail.com, a README name Murizada, and the key
malfexteam2027. It is not an attacker code-signing identity. The AutoIt3
binary remains the vendor-signed interpreter. MAL-2026-17320 covers only
cdn-img-fetch 1.0.0 and 1.0.1.

SafeDep (13 October 2026) found the operator had already replaced the
removed JavaScript loaders. imgdecode, published by malfexteste8,
versions 1.0.0 through 1.0.3, hides the loader in a prebuilt Windows
Node addon. require("imgdecode") loads
prebuilds/win32-x64/imgdecode.node. From 1.0.1 the addon runs during
N-API module init. There is no install script. The routine returns
immediately unless stdout is an interactive Windows console, so CI
jobs with redirected output do not trigger it. It downloads banner.jpg
from the same cavecrew/proj repository, decrypts it, and injects the
result into a suspended dllhost.exe. Version 1.0.3 was published on
11 October, six days after the Checkmarx report, and was still on npm
on 13 October. npm had removed imgbundle on 7 October and
cdn-img-fetch on 8 October. SafeDep recovered banner.png, not
banner.jpg. The stage-2 downloader hash
2f268ca76ab27971d8b16bd4ded26e1f9cd3d4460b894af2d4bdf89f0ab7ec4b is
on the Checkmarx indicator list. SafeDep has not confirmed that
banner.jpg delivers that same payload.

Mapped techniques

supply-chain Attacker-owned npm accounts

T0108 · Resource Development · Accounts in public registry

Publisher handles include malfexkkj, malfex_user, jessica-fruett,
liuxhin, malfexteste2, malfexteste3, malfexteste4, malfexteste8,
and dallascorp. Several used fresh iCloud Hide-My-Email addresses.

T0109 · Resource Development · Publish malicious artifact

Malicious publishes include function-flag, cdn-img-fetch,
function-color, the advised Arm A droppers, and the later
replacements imgbundle, runhelper, and imgdecode. Benign cover
packages (function-ascii, centralizemiddle) sit on the same
accounts.

T0110 · Resource Development · Advertise malicious artifact

function-flag is presented as a font helper. Republishing
1.7.3 moved the latest tag onto a lower version number so a
fresh install looks like a rollback.

T0151 · Execution · Installation scripts

Arm A runs obfuscated preinstall.js and postinstall.js.
function-flag has carried a postinstall since July 2025.
cdn-img-fetch also runs at require time, which install-script
blocking does not cover. imgdecode has no install script.

T0159 · Execution · Malicious artifact execution

imgdecode loads a prebuilt Windows addon on require. From
1.0.1 the loader runs in N-API module init, only when stdout
is an interactive console, then injects decrypted shellcode
into dllhost.exe.

post-supply-chain Windows payload on the developer machine

T0156 · Exfiltration · Exfiltration over webhooks

Arm B's movinlike stealer exfiltrates to a Discord webhook
that was live when CloudSEK wrote the report.

Framework gaps noted

Sources