Malicious npm package 'imgdecode' in MALFEX campaign hides shellcode loader in Windows native addon

40/100

Researchers found a malicious npm package, 'imgdecode', that is part of the MALFEX software supply chain campaign and hides a shellcode loader in a Windows native addon. It was uploaded on September 30, 2026, has been downloaded 979 times and was still available at the time of reporting. Developers should check their dependencies for this package.