MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.
A malicious npm package named 'imgdecode' has been discovered, part of the MALFEX supply chain attack campaign. Uploaded to the npm registry by user 'malfexteste8', the package contains a shellcode loader hidden within a Windows native addon. It has been downloaded nearly a thousand times and remains available on the registry.
AI summary of the linked source. Not reviewed by an editor. How this works
Run imgdecode?
Get an email when a new story names imgdecode, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'imgdecode' npm package, part of the MALFEX campaign, demonstrates how threat actors abuse open-source package registries to distribute malware disguised as legitimate developer tools. By embedding a shellcode loader inside a Windows native addon, attackers exploit the inherent trust developers place in third-party dependencies. The package accumulated nearly a thousand downloads before detection, highlighting the danger of insufficient vetting of open-source components. This attack underscores how a single malicious dependency can compromise an entire software supply chain, potentially affecting all downstream users and applications.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://www.npmjs.com/package/imgdecode
- malware — MALFEX