Malicious npm Package 'imgdecode' Exposed in MALFEX Supply Chain Attack Campaign

Researchers have identified a malicious npm package named 'imgdecode' as part of a software supply chain attack campaign dubbed MALFEX. The package was uploaded to the npm registry on September 30, 2026, by a user named 'malfexteste8'. The package has been downloaded 979 times and is still available on the registry.

The 'imgdecode' package contains a Windows native addon designed to hide and load shellcode. Native Node.js addons, when loaded, can execute arbitrary code with system-level privileges on the host machine. The exact nature of the shellcode loader and the full attack chain are under analysis by researchers, but the presence of a native addon in a seemingly benign package raises significant concerns for development environments.

The package targets Node.js developers and projects incorporating the 'imgdecode' dependency. Compromise of a development workstation could lead to broader network infiltration if malicious code is deployed to production. The campaign name 'MALFEX' and specific technical details are attributed to researcher analysis in the reporting source.