MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have found a malicious npm package called imgdecode, which is part of the MALFEX software supply chain attack campaign. The package was uploaded to the registry by a user named malfexteste8 and has been downloaded nearly a thousand times. It is still available on npm and contains a Windows native addon that hides a shellcode loader. The imgdecode package was uploaded on September 30, 2026. The discovery was made by cybersecurity researchers who are tracking the MALFEX campaign. The package's availability and download history suggest it may have already been used in attacks.