MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers discovered a malicious npm package named imgdecode, part of the MALFEX software supply chain attack campaign. Uploaded on September 30, 2026, by user malfexteste8, the package has 979 downloads. It conceals a shellcode loader within a compiled Node.js addon that executes a Windows dynamic-link library. This campaign has targeted Windows computers since August 6, 2023, highlighting persistent security risks within package registries through the use of translated add-ons to load system files.