Malicious npm Module 'imgdecode' Found Carrying Windows Shellcode Loader

Security researchers have identified a new malicious package on the npm registry, named imgdecode, that embeds a Windows-native shellcode loader. The module was uploaded on September 30, 2026 by an account identified as "malfexteste8" and appears to be part of the broader MALFEX software‑supply‑chain campaign.

The discovery, first reported by The Hacker News, highlights the growing trend of attackers compromising open‑source ecosystems. By publishing a seemingly innocuous library, threat actors can infiltrate countless downstream projects that automatically pull dependencies from npm, potentially executing malicious code on victim machines without direct user interaction.

Analysis of the imgdecode package shows it is a compiled native addon for Windows. Within the binary, researchers found obfuscated code that, when triggered, loads and runs shellcode—a technique commonly used to deliver payloads such as ransomware or credential‑stealing tools. The loader is concealed behind functions that mimic image‑decoding operations, making static analysis more difficult.

While the exact targets of the MALFEX campaign remain under investigation, the use of a Windows‑specific payload suggests the attackers are focusing on environments where Node.js applications run on Windows servers or developer workstations. Supply‑chain attacks of this type can spread rapidly, as any project that lists imgdecode as a dependency may inadvertently distribute the malicious code to its own users.

npm has responded by removing the package from its registry and issuing a warning to developers. The platform also advises maintainers to audit their dependency trees, employ lock‑file verification, and consider using tools that detect anomalous native modules. Security experts recommend enabling two‑factor authentication for npm accounts to reduce the risk of compromised publish credentials.

The incident underscores the importance of rigorous supply‑chain hygiene in modern software development. As open‑source components become integral to applications across industries, continuous monitoring and verification of third‑party packages are essential defenses against covert threats like the MALFEX operation.