MALFEX Operator Swaps Removed Packages for imgdecode DLL Loader Within Hours

The MALFEX campaign, active since August 2023 across five publisher accounts, has repeatedly adapted to npm takedowns. After removal of native-runner and img-to-native on 28 September, the actor published imgbundle, runhelper, then imgdecode within 48 hours. imgdecode abandons postinstall hooks and the prior Go stealer chain in favor of a native addon that directly executes shellcode, reducing observable artifacts during package load. SafeDep telemetry shows 979 downloads of imgdecode before any removal action. The operator's use of Koffi FFI in runhelper and compiled DLLs in imgdecode indicates deliberate escalation from pure JavaScript loaders to evade static scanning. Timeline gaps between unpublishing and replacement average under six hours, revealing automated or pre-staged package workflows. No independent technical attribution ties the five handles to a named group; only shared infrastructure and naming patterns connect them. The continued availability of imgdecode as of the reporting date leaves any downstream Node.js project on Windows exposed to the GitHub-hosted payload. npm's delayed response to the replacement packages suggests gaps in automated detection for native addons versus scripted hooks.