A malicious npm package called imgdecode has been found hiding a shellcode loader in a Windows native addon. Part of the MALFEX campaign, it's been downloaded 979 times and is still live. Here's what you need to know.
You know how we all trust npm packages a little too much? Well, here's a story that might make you think twice. Researchers have uncovered a malicious npm package called **imgdecode** that's part of a larger software supply chain attack campaign dubbed **MALFEX**. It was uploaded on September 30, 2026, by a user named "malfexteste8," and at the time of writing, it's been downloaded 979 times and is still live on npm. Yeah, that's not great.
### What exactly is imgdecode doing?
According to the researchers, imgdecode isn't your average sketchy package. It hides a shellcode loader inside a Windows native addon. That means when you install it, it can execute arbitrary code on your machine, potentially giving attackers a foothold to steal data, install more malware, or move laterally across your network. And because it's a native addon, it can bypass some of the usual JavaScript sandboxing, making it even sneakier.
### Why should you care?
If you're a developer, you might be thinking, "Well, I don't use imgdecode, so I'm fine." But that's the thing about supply chain attacks—they often start with a single compromised package and then spread through dependencies. Even if you don't directly use imgdecode, it could be a transitive dependency of something else you rely on. Plus, the MALFEX campaign seems to be actively targeting the npm ecosystem, so it's worth paying attention.
> "Supply chain attacks are like a wolf in sheep's clothing—they look harmless until they're not. Always verify your dependencies." — Emily Davis, Head of Digital Privacy and Antidetect Browser Solutions at Antidetectbrowsershub
### How can you protect yourself?
Here are a few practical steps you can take right now:
- **Audit your dependencies regularly.** Tools like `npm audit` can help flag known vulnerabilities, but they won't catch everything. Consider using software composition analysis (SCA) tools for deeper checks.
- **Lock down your package versions.** Use a lockfile (package-lock.json or yarn.lock) to ensure you're not pulling in unexpected updates.
- **Monitor for suspicious activity.** Keep an eye on network traffic and process behavior on your build servers and developer machines.
- **Educate your team.** Make sure everyone knows about the risks of installing untrusted packages and the importance of verifying package integrity.
### The bigger picture
The MALFEX campaign is a reminder that the open-source ecosystem, while amazing, isn't immune to bad actors. It's a shared responsibility—package maintainers, registry operators, and developers all play a role in keeping things secure. So next time you run `npm install`, take a moment to think about what you're really pulling in. Stay safe out there.
And if you're curious about how antidetect browsers can help protect your privacy while browsing or testing, check out our other resources. We're always here to help you navigate the wild west of the web.
