Researchers found a malicious npm package called 'imgdecode' that hides a shellcode loader in a Windows native addon. It's been downloaded 979 times and is still live. Here's what you need to know.
So you're building a project, and you need a package called 'imgdecode' to handle images. Seems harmless, right? Well, think again. Researchers just found that this npm package, part of a campaign called MALFEX, is actually a trojan horse—it hides a shellcode loader inside a Windows native addon.
Here's the kicker: the package was uploaded on September 30, 2026, by a user named 'malfexteste8.' It's been downloaded 979 times and is still sitting there on npm as we speak. So if you've recently added it to your dependencies, you might want to check your system.
### What Exactly Is MALFEX?
MALFEX is a software supply chain attack campaign that's been making the rounds lately. The idea is simple: attackers upload malicious packages to public registries like npm, and developers unknowingly install them. Once installed, the package can execute arbitrary code, steal data, or open backdoors.
In this case, 'imgdecode' doesn't just decode images—it loads shellcode. Shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It's often used to spawn a reverse shell, giving attackers remote access to your machine.
> "Supply chain attacks are the new frontier. You can have the most secure code in the world, but if your dependencies are compromised, you're toast." — Anonymous security researcher
### How Does It Work?
The malicious code is hidden in a Windows native addon. Native addons are modules written in C or C++ that can be loaded by Node.js. They're powerful but also dangerous because they run outside the JavaScript sandbox. The addon in 'imgdecode' likely contains a shellcode loader that executes when the package is required.
We don't have all the details yet, but here's what we know:
- The package was uploaded by a user with a suspicious name: 'malfexteste8'.
- It has been downloaded 979 times.
- It's still available on npm.
- The latest version of the package is [version not disclosed].
### What Should You Do?
First, if you have 'imgdecode' in your project, remove it immediately. Run `npm uninstall imgdecode` and then audit your dependencies for anything else suspicious. Second, check your system for signs of compromise—unusual network traffic, new user accounts, or strange processes running.
Third, always be cautious with packages from unknown authors. Check the download count, the repository, and the author's history. If something seems off, it probably is.
### The Bigger Picture
This isn't the first time npm has been used to distribute malware, and it won't be the last. The npm registry is a big target because it's so widely used. Attackers know that if they can get a malicious package into the registry, it's only a matter of time before someone installs it.
So what's the takeaway? Trust but verify. Even packages with a few hundred downloads can be malicious. Stay safe out there.
We'll keep you posted as more details emerge about MALFEX and the 'imgdecode' package.
