MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Cybersecurity experts have uncovered a deceptive npm package named imgdecode, which is part of a software supply chain attack campaign called MALFEX. Uploaded on September 30, 2026, this package has been downloaded 979 times and remains available on the npm registry. The malicious imgdecode package hides a loader in a compiled Node.js addon, as reported by SafeDep.
Upon being required in a Windows console, the DLL component attempts to download encrypted shellcode from GitHub and injects it into a new dllhost.exe process. First detected by Checkmarx and CloudSEK, MALFEX is a campaign where threat actors have been publishing malicious packages to npm since August 6, 2023. Three of the eight identified packages act as loaders for the Overlord RAT, while three others (cdn-img-fetch, img-to-native, and native-runner) collaborate to download and run a Node.js stealer.
The threat actor responds to public disclosures and npm removals by swiftly publishing replacements, such as runhelper and imgdecode. The former functions similarly to native-runner, while the latter hides a malicious loader in a compiled Node.js addon. The imgdecode package is significant as it runs its malicious code when native-runner is loaded and lists img-to-native as its dependency.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
