MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Summary: Researchers found a malicious npm package called "imgdecode," uploaded September 30, 2026, by user "malfexteste8" and downloaded 979 times, that hides a loader in a compiled Node.js addon which downloads encrypted shellcode from GitHub and injects it into a new dllhost.exe process. It is part of the MALFEX campaign, which has published malicious packages under five npm handles since August 6, 2023, and whose operator replaced removed packages within two days, publishing imgdecode six hours after runhelper was unpublished.
Why it matters: The operator rebuilt a working loader within six hours of a takedown, and version 1.0.3 of imgdecode needs no other MALFEX package to run, so removal of one package does not remove the capability. The payload harvests .kdbx, .pem, .ppk and .env files, browser and wallet data, and seed phrases, and any developer who installed these packages should treat their Windows system as compromised.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026