What happened in this Tech story?

Researchers found a malicious npm package named 'imgdecode' that conceals a shellcode loader inside a Windows native addon as part of the MALFEX software supply chain attack campaign.

What is a key fact in this story? (1)

**imgdecode** npm package, uploaded September 30, 2026 by user 'malfexteste8,' conceals a shellcode loader inside a Windows native addon.

What is a key fact in this story? (2)

The package belongs to a recently disclosed software supply chain attack campaign dubbed **MALFEX**, identified by cybersecurity researchers.

'imgdecode' npm Hides Shellcode Loader in Windows Addon — SkimNews

By The Hacker News · Summarized & edited by Kapil Samant · 2026-10-17

Get the Tech newsletter

Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.

imgdecode npm package, uploaded September 30, 2026 by user 'malfexteste8,' conceals a shellcode loader inside a Windows native addon.
The package belongs to a recently disclosed software supply chain attack campaign dubbed MALFEX, identified by cybersecurity researchers.

Why it matters: The MALFEX campaign hides Windows-specific shellcode inside a package distributed through the cross-platform npm registry, meaning any developer who installed 'imgdecode' on a Windows machine likely ran hidden payload code without realizing it — a reminder that native addons can quietly carry platform-targeted malware.