MALFEX npm Package „imgdecode” Conceals Windows Shellcode Loader

Hidden Payload Within a Popular Dependency

Cybersecurity researchers uncovered a malicious npm package linked to the recently exposed supply‑chain attack campaign known as MALFEX. The package, called „imgdecode,” was uploaded to the npm registry on September 30, 2026 by a user named „malfexteste8.” By the time of writing, it had been downloaded 979 times and remains available for installation.

Why Developers Are at Risk

The investigation revealed that „imgdecode” contains a native Windows addon written in C. When executed, the addon silently downloads a shellcode loader from a remote server and injects it into a running process. This loader then establishes a backdoor, allowing attackers to execute arbitrary commands on the compromised machine. The package’s name and innocuous description mislead developers into trusting it as a harmless image‑decoding utility.

What Can Be Done to Protect Your Projects?

The researchers noted that the malicious code is embedded in a compiled binary that is packaged as part of the npm module. The binary is executed automatically when the module is required, a common pattern for native addons. Because the source code is not visible, developers cannot inspect the payload before installation. The loader’s download URL was encoded in a base‑64 string, making it difficult to spot during static analysis. Once the loader is in memory, it uses Windows API calls to create a hidden process and opens a reverse shell to the attacker’s command‑and‑control server.

The attack exploits the trust model of the npm ecosystem. Many projects declare „imgdecode” as a dependency in their package.json files, assuming it is a benign utility. When these projects are built or run, the malicious addon is executed without user knowledge. The researchers estimate that over 200 open‑source projects across various industries may have incorporated the package. Because the module is lightweight and has no obvious malicious behavior, it can slip past routine security scans that focus on code rather than compiled binaries.

Frequently Asked Questions

Security teams should audit the native binaries included in their dependencies. Tools that perform binary integrity checks or signature verification can flag unknown or unsigned modules. Updating dependency lists to remove unused packages and using lock files that pin exact versions also reduces the risk of inadvertently installing compromised code.