MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

What happened

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack (an attack that reaches a target through software it depends on) campaign dubbed MALFEX. MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon  Ravie Lakshmanan  Oct 17, 2026 Malware / Windows Security Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX .

Of the eight identified packages, three were found to act as a loader for Overlord RAT, while three others ("cdn-img-fetch," "img-to-native," and "native-runner") worked together to download and run a Node.js stealer. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8."

It has been downloaded 979 times as of writing and is still available on npm as of writing.

The latest version of the package is 1.0.3. "The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said .

"Its nine-line JavaScript (high-level programming language) file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process." First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems.

These packages were published across five npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4.