Malicious npm package imgdecode hides a Windows shellcode loader

Security researchers have found another malicious npm package tied to a long-running campaign called MALFEX, The Hacker News reported on October 17, 2026, based on research from SafeDep. The package, imgdecode, was first uploaded on September 30 and had been downloaded 979 times. It was still on npm when the report was written.

The JavaScript part of the package is only nine lines and looks harmless. The danger sits in a compiled Node.js add-on. When a program loads imgdecode on Windows, a DLL inside it downloads encrypted shellcode from GitHub, decrypts it and injects it into a new dllhost.exe process. The latest version, 1.0.3, no longer needs any other package from the campaign to work.

MALFEX has been publishing malicious packages since August 2023 under several publisher names, with earlier packages delivering the Overlord remote access trojan and a Node.js data stealer. The researchers say the attacker reacts quickly to takedowns: after npm removed two packages in late September, replacements appeared within two days, and imgdecode was published the same day. Some packages in the chain had no install hook at all, so the bad code ran only when the module was loaded.

Why it matters

Native add-ons can hide code that a quick look at a package's JavaScript will miss, so pin dependencies and scan new packages before using them.

Source: The Hacker News