MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The MALFEX campaign plants shellcode inside a native Node.js addon on npm, escalating supply-chain attack sophistication beyond script-level tampering and evading source-only scanning tools.
Summary written by editorial AI · Source link below
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX.
The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of
Editorial Analysis
Compiled native addons in package registries bypass source-code-level security scans, meaning organisations relying solely on SAST for dependency vetting have a dangerous blind spot.
Extend dependency-scanning policies to cover native addons and binary artifacts in npm packages; enforce provenance attestation and code-signing requirements in CI/CD.
A malicious npm package hides shellcode in a compiled addon, demonstrating that software supply-chain attacks are growing more evasive.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the DevSecOps Desk
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated3d
- No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild4d
- Railway warns devs to rotate secrets after potential breach4d
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass5d
- eMudhra CA Incident: Sonatype's Assessment and Guidance5d