← Back to blog

Malicious npm Package 'imgdecode' Distributes Shellcode Loader

A newly discovered npm package named 'imgdecode' is being used in a supply chain attack to deliver malicious shellcode. The package leverages a Windows native addon to evade detection.

TL;DR

  • Cybersecurity researchers uncovered a malicious npm package called 'imgdecode'.
  • It hides a shellcode loader within a Windows native addon.
  • Uploaded on September 30, 2026, it has been downloaded nearly 1,000 times.
  • The package is part of a broader campaign known as MALFEX.
  • Developers are urged to audit dependencies and monitor for suspicious activity.

Security researchers have identified a malicious npm package named 'imgdecode', which is actively being used in a software supply chain attack. This package conceals a shellcode loader inside a Windows native addon, making it particularly dangerous due to its ability to bypass traditional security measures.

Published on September 30, 2026, by a user identified as 'malfexteste8', the package had already accumulated 979 downloads at the time of reporting. Despite being flagged, it remains accessible on the npm registry, heightening concerns over potential ongoing exploitation.

Attack Vector and Technical Details

  • The 'imgdecode' package uses a native Node.js addon to execute hidden shellcode.
  • This technique obscures malicious behavior from static analysis tools.
  • Its Windows-specific payload suggests targeted delivery rather than broad distribution.
  • The package mimics legitimate functionality to avoid suspicion during installation.

Implications for Developers and Organizations

  • Teams using npm should review their dependency tree for 'imgdecode'.
  • Supply chain attacks like MALFEX underscore the need for strict package verification.
  • Automated security scanning tools may fail to detect such obfuscated threats.
  • Proactive monitoring and runtime protection can help mitigate similar risks.

Sources

Sources

Security email updates

One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.