{"id":"thehackernews-219fd9eab491","seq":2939,"kind":"news","title":"MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","url":"https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html","permalink":"https://vulnpulse.app/items/thehackernews-219fd9eab491","summary":"Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of","severity":null,"techs":["nodejs"],"cves":[],"tags":["security"],"source":{"id":"thehackernews","name":"The Hacker News"},"published_at":"2026-10-17T11:11:56.000Z","fetched_at":"2026-10-21T16:17:48.024Z"}