Malicious npm Package 'imgdecode' Hid a Shellcode Loader in Plain Sight

Robert Moore · 2026-10-17

Researchers have found a malicious npm package called "imgdecode" that quietly smuggles a shellcode loader inside a Windows native addon. It's tied to a supply chain campaign the security community is calling MALFEX. And here's the part that should make you pause: it was still sitting on npm when the report came out. The package went up on September 30, 2026, published by a user going by "malfexteste8." By the time researchers wrote it up, it had racked up 979 downloads. That's not a massive number, but it's 979 machines too many. ### Why a Native Addon Is the Perfect Hiding Spot Most people scanning npm packages look at the JavaScript. They might glance at the install scripts. But a native addon? That's a compiled binary, often a `.node` file on Windows, and it slips right past the kind of casual review most of us do. That's the whole trick here. The malicious logic doesn't live in readable JS. It sits inside something that looks like a normal performance helper and runs with the full trust of your Node process. - It targets Windows specifically, so Mac and Linux users dodged this one - The loader pulls shellcode, which means the real payload can change on the fly - The package name sounds boring and functional, exactly what attackers want ### What MALFEX Actually Tells Us MALFEX isn't a single package. It's a campaign, a pattern of attackers seeding the registry with lookalike or plausible-sounding packages and waiting for developers to pull them in. "imgdecode" is just one face of it. > The scariest supply chain attacks don't break down your door. They get added to your dependencies by a tired developer at 11 p.m., and nobody notices for weeks. That's the reality. Your `node_modules` folder is a small city of code written by strangers, and every native binary inside it runs with real privileges. ### What You Can Do About It You don't need to panic, but you do need a few habits. - Lock your dependencies and review anything new that shows up in a diff - Be suspicious of packages with very few downloads that suddenly appear as dependencies - Watch for native addons you didn't explicitly ask for - Run installs in containers or sandboxes when you're testing unfamiliar code If you're doing any kind of privacy-sensitive work, whether that's managing multiple accounts or keeping your browsing fingerprint clean, a compromised dev environment undoes all of it. An antidetect browser protects your identity online, but it can't protect you from a shellcode loader running on your own machine. ### The Bigger Picture This is the third or fourth MALFEX-adjacent package to surface, and it won't be the last. The npm registry is enormous, and moderation is reactive, not proactive. Packages stay up until someone reports them. So treat every new dependency like a stranger at your door. Ask who published it, when, and why it's there. That thirty-second check is cheaper than a cleanup. The "imgdecode" package is a reminder that supply chain security is a habit, not a product you buy once and forget.