MALFEX Campaign: Malicious npm Package 'imgdecode' Delivers Windows Shellcode via Native Addon

What Happened

Researchers have identified a malicious npm package, imgdecode, as part of a software supply chain attack campaign tracked as MALFEX. According to the report, the package was uploaded to the npm registry on September 30, 2026, by a user named malfexteste8, and had been downloaded 979 times at the time of publication. As of the report, the package remained live on npm.

The package reportedly hides a shellcode loader inside a Windows native addon — a compiled binary component bundled with the npm package rather than plain JavaScript. Full technical details of the loader's behavior were not available at the time of this writing.

Why It Matters

Native addons are compiled code invoked from Node.js and are far less likely to be reviewed line-by-line than JavaScript dependencies, making them an effective place to conceal a loader. Any developer or CI/build system on Windows that installed imgdecode — directly or as a transitive dependency — could have executed the embedded shellcode loader. Supply chain compromises of this kind can affect individual developer workstations as well as automated build pipelines, with downstream impact on anything those systems touch.

What Defenders Should Watch For

• Inventory npm dependency trees (including transitive dependencies) for a package named imgdecode, particularly any installed or updated after September 30, 2026.
• Review npm packages that ship native addons (.node binaries, node-gyp/binding.gyp build steps) with extra scrutiny, since compiled code bypasses typical JS-focused code review.
• On Windows build and developer hosts, monitor for unexpected child processes or network connections spawned from node.exe or npm install/build steps, which can indicate loader execution.
• Flag unusual process injection, memory allocation, or execution behavior originating from Node.js native module loading in EDR telemetry.
• If imgdecode is found in any dependency manifest or lockfile, treat the affected host as potentially compromised pending investigation, and remove the package.

Developing Story

This is net-new intelligence on an active, still-live malicious package, and further technical details of the MALFEX campaign may emerge. For the original reporting, see The Hacker News.