Security1 hOctober 17, 2026, 18:11

Malicious npm package imgdecode hides shellcode loader in Windows native addon

Researchers found a malicious npm package named imgdecode tied to the MALFEX software supply chain attack campaign. Uploaded on September 30, 2026 by user malfexteste8, it had 979 downloads and remains available on npm.

The Hacker News

Open source

Malicious npm package imgdecode hides shellcode loader in Windows native addon

imgdecode hides a shellcode loader inside a native Windows addon
Uploaded to npm on September 30, 2026 by user malfexteste8
Downloaded 979 times and still available on the registry
Linked to the MALFEX software supply chain campaign

#Npm#MALFEX

npm worms hide malicious hooks in AI agent config files

Security

Hackers hide malware commands in blockchains as malicious activity jumps 440%

Security

Volexity: UTA0560 shares shellcode with activity attributed to APT31

Security

Malicious npm package imgdecode hides shellcode loader in Windows native addon

npm worms hide malicious hooks in AI agent config files

Hackers hide malware commands in blockchains as malicious activity jumps 440%

Volexity: UTA0560 shares shellcode with activity attributed to APT31

NPM malware campaign MALFEX hits 40,000 downloads