MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

SafeDep researchers have found a malicious npm package named “imgdecode” that hides a shellcode loader in a Windows native addon as part of the MALFEX software supply chain campaign, The Hacker News reports. The package was uploaded on Sept. 30, 2026, has been downloaded 979 times and remains available on npm.