The package, named imgdecode, was uploaded to the npm registry on September 30, 2026, by a user operating under the name malfexteste8. According to the researchers, the package conceals a shellcode loader within a Windows native addon, allowing malicious code to be loaded through what appears to be a legitimate library component.

At the time of reporting, imgdecode had been downloaded 979 times and remained available on npm. The report does not specify a CVE identifier for this package.

Key details:

• Package name: imgdecode
• Registry: npm
• Upload date: September 30, 2026
• Publisher account: malfexteste8
• Download count: 979 as of writing
• Status: still available on npm as of writing
• Technique: shellcode loader hidden in a Windows native addon

If your organization relies on npm dependencies, it is worth checking whether imgdecode appears in your lockfiles or dependency trees, and reviewing any installs tied to the malfexteste8 publisher account while the package remains live.

Source: The Hacker News

Has your team audited its npm dependencies for this package or other artifacts linked to the MALFEX campaign?