MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

October 17, 2026 · 11:11 am 1 sources

Image: The Hacker News

Coverage

More coverage

• MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
  The Hacker News · October 17, 2026 11:11
  Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been…