Security · Updated 17 Oct, 04:41 pm IST

Malicious npm package 'imgdecode' hides Windows shellcode loader

Why it matters for readers: It demonstrates how attackers hide malicious loaders inside legitimate-looking packages to run code on Windows.

Researchers linked the package to a broader software supply-chain campaign called MALFEX.1
The malicious package is named 'imgdecode' and hides a shellcode loader inside a Windows native addon.1
It was uploaded to npm on September 30, 2026 by a user named 'malfexteste8'.1
As of the report, 'imgdecode' had been downloaded 979 times and remained available on the npm registry.1

Get a brief like this every morning

Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.