As cited
Copy frozen at (site build).
threat intel
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Researchers identified a malicious npm package called "imgdecode" uploaded September 30, 2026, as part of the MALFEX campaign. The package contains a Windows native addon that loads shellcode and had been downloaded 979 times before discovery. The package remained available on the npm registry at the time of reporting.
Why it matters: JavaScript developers and npm users are at risk of supply chain compromise if they installed imgdecode; organizations should audit dependencies and check for this package in their software bill of materials.
- Source published
- First seen by Cybersecurity Tracker