That Innocent npm Package? It Was Quietly Loading Shellcode

Michael Miller · 2026-10-17

You know that feeling when you install a small utility package and forget about it? That's exactly what attackers are counting on. Researchers just flagged a package called "imgdecode" on npm, and it's a textbook example of how a supply chain attack sneaks past our radar. Here's the short version. The package showed up on the registry on September 30, 2026, uploaded by a user going by "malfexteste8." It's been pulled down 979 times so far. And as of this writing, it's still sitting there on npm, available for anyone to install. ### What MALFEX Is Actually Doing This isn't a one-off prank. "imgdecode" is tied to a broader campaign researchers are calling MALFEX, and the trick is clever in a nasty way. The package hides a shellcode loader inside a Windows native addon. If that phrase sounds abstract, think of it like this. A native addon is the part of a package that runs compiled machine code right on your system, outside the safety rails of JavaScript. It's the difference between asking a friend to read a note for you and handing them the keys to your house. Once that addon loads, the shellcode goes with it. - **The disguise:** a package that looks like it handles image decoding, a boring, believable utility - **The payload:** a shellcode loader tucked into a Windows native addon - **The delivery:** a standard npm install, no warning signs required - **The status:** still live on npm, still downloadable That last bullet is the one that should make you pause. ### Why This Matters More Than It Seems Supply chain attacks like this don't need to be sophisticated to work. They need to be patient. A package sits in the registry, gets a handful of downloads, and waits for the right developer to pull it into a build pipeline. And here's the part that stings: 979 downloads isn't a huge number, but it's not nothing either. Every one of those installs could be a machine that's now running code nobody audited. > "The most dangerous dependency is the one you never think about again." That's not a quote from a researcher. It's just how this stuff works. ### What You Can Do Right Now A few practical moves, nothing fancy: - If "imgdecode" shows up anywhere in your dependency tree, remove it today and check the machines that ran it - Audit your lockfiles for unfamiliar packages, especially ones with recent upload dates - Treat native addons with extra suspicion, since they execute compiled code directly - Set up alerts for new dependencies in your projects so surprises don't sit unnoticed for weeks This is also a good moment to think about how you isolate the environments where you install and test packages. If a rogue dependency slips through, you want the blast radius to be small and contained, not your entire workstation or build server. ### The Bigger Picture MALFEX is a reminder that the npm ecosystem's openness is both its superpower and its weak spot. Anyone can publish. That's great for innovation and rough for security. The package is still out there as of this writing. So if you take one thing from this, let it be this: check your dependencies. Not next quarter. Today. The boring five-minute audit is worth more than the cleanup you'd rather avoid.