Researchers found a malicious npm package called imgdecode that hides a shellcode loader in a Windows native addon. Part of the MALFEX campaign, it's still live and has been downloaded 979 times. Here's what you need to know.
### A Wolf in Sheep's Clothing
Picture this: you're installing what looks like a harmless image decoding utility from npm, but behind the scenes, it's quietly loading shellcode into your Windows machine. That's exactly what researchers uncovered with a package called **imgdecode**. It's part of a sneaky software supply chain attack campaign they've dubbed **MALFEX**.
The package was uploaded to the npm registry on September 30, 2026, by a user named **malfexteste8**. By the time researchers flagged it, it had already been downloaded **979 times**—and as of this writing, it's still sitting there, live and available. The latest version? It's the one doing the dirty work.
### How It Slips Through the Cracks
What makes imgdecode so dangerous is its disguise. On the surface, it claims to be a simple image decoder—something a developer might grab without a second thought. But hidden inside is a **Windows native addon** that acts as a shellcode loader. Once installed, it can execute arbitrary code on your system, giving attackers a foothold they can use to drop malware, steal data, or pivot deeper into your network.
This isn't a smash-and-grab. It's a patient, targeted attack that relies on trust in open-source ecosystems. And npm, being the massive repository it is, makes it far too easy for malicious packages to blend in.
### The Bigger Picture: Supply Chain Attacks Are Evolving
MALFEX is just the latest reminder that supply chain attacks are getting more sophisticated. Attackers aren't just targeting big corporations anymore—they're going after the tools developers use every day. A single compromised package can ripple out to thousands of projects.
> "The imgdecode package is a textbook example of how attackers exploit the trust developers place in package registries. It's not about sophistication; it's about patience and disguise."
So what can you do? Here's a quick checklist:
- **Vet your dependencies**: Before installing any package, check its download history, maintainer reputation, and recent updates. A sudden spike in downloads or a brand-new maintainer can be red flags.
- **Use lockfiles**: They won't stop a malicious package from being installed, but they'll keep you from accidentally pulling a compromised version later.
- **Monitor for unusual behavior**: If a package suddenly starts making network calls or spawning processes, that's a sign something's off.
- **Consider antidetect browsers for testing**: When you're analyzing suspicious packages, an antidetect browser can help you isolate your environment and avoid leaving traces that attackers might exploit.
### What Happens Next
As of now, imgdecode remains on npm, which means the window for infection is still open. If you've installed it, you should immediately remove it and scan your system for any signs of compromise. The researchers haven't disclosed the full extent of the campaign, but they're urging developers to stay vigilant.
Supply chain attacks like MALFEX aren't going away. They're a reminder that in the world of open-source, trust is a double-edged sword. Stay safe out there—and maybe think twice before you npm install that shiny new package.
