## MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

- 種別: news
- 関連技術: nodejs
- 公開日時: 2026-10-17T11:11:56.000Z
- 情報源: The Hacker News (https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)
- パーマリンク: https://vulnpulse.app/items/thehackernews-219fd9eab491

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of