Researchers discovered a malicious npm package called "imgdecode" that conceals a shellcode loader within a Windows native addon. The package was uploaded to npm on September 30, 2026, by a user identified as "malfexteste8" and is connected to the MALFEX software supply chain attack campaign.
The package accumulated 979 downloads before detection and remained available on npm at the time of reporting. The malicious code hides within a Windows native addon component, allowing it to execute shellcode on affected systems. This delivery method bypasses traditional JavaScript-level detection by embedding compiled malicious code in binary form.
The MALFEX campaign represents a broader threat to the npm ecosystem, where attackers compromise or create packages to distribute malware to developers and end users. By disguising the malicious payload as a legitimate image decoding library, the attackers relied on the package name to appear benign and functional.
The timing and naming strategy reflect common supply chain attack tactics. Attackers register accounts with generic or test-like usernames, upload packages with functional-sounding names, and leverage the trust developers place in open-source repositories. The shellcode loader mechanism allows attackers to execute arbitrary code remotely, potentially enabling command execution, data theft, or further system compromise.
Researchers flagged the package for removal from npm following discovery. Organizations that downloaded imgdecode during this window should audit their systems for signs of compromise. Developers should review their dependency lists and remove any versions of imgdecode installed in projects or development environments.
This incident underscores ongoing risks in the npm package ecosystem, where millions of packages exist and automated scanning cannot catch all malicious submissions. Supply chain attacks targeting open-source repositories continue to pose significant risks to software development pipelines and end-user systems.