[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv76uK31ZHtQMKy5xdLP_KHTLDUkUyCuICgulC5eJqrQ":3},{"article":4,"iocs":47,"watch_terms":54,"solutions":55,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"37f542e3-cdc3-4eae-954f-9b63f5fad920","MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon","malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-219fd9","Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named \"imgdecode,\" was uploaded to the package registry on September 30, 2026, by a user named \"malfexteste8.\" It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of","A malicious npm package named 'imgdecode' has been discovered, part of the MALFEX supply chain attack campaign. Uploaded to the npm registry by user 'malfexteste8', the package contains a shellcode loader hidden within a Windows native addon. It has been downloaded nearly a thousand times and remains available on the registry.","Malicious npm package 'imgdecode' hides shellcode loader in Windows native addon.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fmalfex-npm-package-imgdecode-hides.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh8fNb_yEvP6C_CENfQMUx3EDGofY1ejEHusnumTjCLnX3s8pevEbl_cgrtFHhzeEUhyphenhyphenyKe_X41OzQOGL5zlXeLLBnj_ZrLqH1IUag1QWm4QS9V2hgc5ucEzEZKjhstvtde8CFs8anPSZv9w3op67F8Q_MHVC_demESnH8lpAYLLpIRizCyvF5gsi5PDKzm\u002Fs1600\u002Fnpm-dll.jpg","2026-10-17T11:11:56+00:00","2026-10-17T12:00:05.211098+00:00",8,[17,20,23],{"name":18,"type":19},"imgdecode","product",{"name":21,"type":22},"npm","technology",{"name":24,"type":25},"MALFEX","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52],{"type":49,"value":50,"context":51},"url","https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fimgdecode","Malicious npm package 'imgdecode' URL",{"type":30,"value":24,"context":53},"Name of the supply chain attack campaign",[18],{"controls":56,"vendors":137},[57,86,111],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":46,"name":87,"problem":88,"products":89},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":107,"product_name":108,"url":109,"description":110},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":112,"name":113,"problem":114,"products":115},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":152},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","The 'imgdecode' npm package, part of the MALFEX campaign, demonstrates how threat actors abuse open-source package registries to distribute malware disguised as legitimate developer tools. By embedding a shellcode loader inside a Windows native addon, attackers exploit the inherent trust developers place in third-party dependencies. The package accumulated nearly a thousand downloads before detection, highlighting the danger of insufficient vetting of open-source components. This attack underscores how a single malicious dependency can compromise an entire software supply chain, potentially affecting all downstream users and applications.",[143,144,145,146,147,148,149,150,151],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SSDF PW.4: Reuse Existing, Well-Secured Software","OWASP A06:2021 – Vulnerable and Outdated Components","SLSA Supply Chain Integrity Framework (Level 2+)","GDPR Article 32: Security of Processing (for EU-affected organizations handling user data)",{}]