Cybersecurity researchers have identified a malicious npm package, 'imgdecode,' as part of the MALFEX software supply chain attack campaign. This package was uploaded to the npm registry on September 30, 2026, by a user identified as 'malfexteste8.'
The 'imgdecode' package contains a shellcode loader concealed within a Windows native addon. As of the report, it has been downloaded 979 times and remains available on the npm registry.
By the numbers
- Downloads of 'imgdecode' package
- 979
Sources and references
Original report
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00IJEN8D
Cite this
APA
Interestana AI Editorial. (2026, October 17). Malfex npm Package 'imgdecode' Hides Shellcode Loader. Interestana. https://interestana.com/articles/malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-00ijen8d
MLA
“Malfex npm Package 'imgdecode' Hides Shellcode Loader.” Interestana, 17 Oct. 2026, interestana.com/articles/malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-00ijen8d.
Chicago
Interestana AI Editorial. “Malfex npm Package 'imgdecode' Hides Shellcode Loader.” Interestana, October 17, 2026. https://interestana.com/articles/malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-00ijen8d.
BibTeX
@misc{interestana_00ijen8d,
author = {{Interestana AI Editorial}},
title = {{Malfex npm Package 'imgdecode' Hides Shellcode Loader}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-00ijen8d},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html}
}Credit the source
Original reporting: The Hacker News, “MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon”, https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe