imgdecode

Malicious npm Package 'imgdecode' Exposed in MALFEX Supply Chain Attack Campaign

A malicious npm package named 'imgdecode' was uploaded to the public registry on September 30, 2026, as part of a software supply chain attack campaign identified as MALFEX. The package, uploaded by a user operating under the npm username 'malfexteste8', contains a Windows native addon designed to hide and load shellcode. With 979 downloads recorded while available, the package poses a risk to development environments and Node.js applications. The package remains available on npm as of the reporting date.