MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
-
Cybersecurity researchers have uncovered a malicious npm package tied to a recently disclosed software supply chain attack campaign tracked as MALFEX.
The package, named imgdecode, was uploaded to the npm registry on September 30, 2026, by a user operating under the name malfexteste8. According to the researchers, the package conceals a shellcode loader within a Windows native addon, allowing malicious code to be loaded through what appears to be a legitimate library component.
At the time of reporting, imgdecode had been downloaded 979 times and remained available on npm. The report does not specify a CVE identifier for this package.
Key details:
- Package name: imgdecode
- Registry: npm
- Upload date: September 30, 2026
- Publisher account: malfexteste8
- Download count: 979 as of writing
- Status: still available on npm as of writing
- Technique: shellcode loader hidden in a Windows native addon
If your organization relies on npm dependencies, it is worth checking whether imgdecode appears in your lockfiles or dependency trees, and reviewing any installs tied to the malfexteste8 publisher account while the package remains live.
Source: The Hacker News
Has your team audited its npm dependencies for this package or other artifacts linked to the MALFEX campaign?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login