MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have identified a malicious npm package named 'imgdecode' as part of the MALFEX software supply chain attack campaign. The package was uploaded to the npm registry on September 30, 2026, by a user named 'malfexteste8'. It has been downloaded approximately 979 times and remains available on npm. The package hides a shellcode loader within a Windows native addon, making it particularly dangerous as it can execute arbitrary code on victim machines. This discovery highlights the ongoing risks associated with software supply chain attacks targeting the npm ecosystem. The campaign name MALFEX suggests a coordinated effort to distribute malware through legitimate package registries.