[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fuJqVwW_1Vbx8dsmo2zn4pjrB9Qqpmrm6DsKsw4Offo8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":55},"cfa20bb2-aad5-4b7a-af87-40645dd802e7","malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","37f542e3-cdc3-4eae-954f-9b63f5fad920","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","The 'imgdecode' npm package, part of the MALFEX campaign, demonstrates how threat actors abuse open-source package registries to distribute malware disguised as legitimate developer tools. By embedding a shellcode loader inside a Windows native addon, attackers exploit the inherent trust developers place in third-party dependencies. The package accumulated nearly a thousand downloads before detection, highlighting the danger of insufficient vetting of open-source components. This attack underscores how a single malicious dependency can compromise an entire software supply chain, potentially affecting all downstream users and applications.","**Immediate actions:**\n- Audit all current projects for the 'imgdecode' package and remove it immediately, then scan affected systems for shellcode execution artifacts.\n- Block or quarantine the package using your organization's npm proxy or private registry (e.g., Artifactory, Verdaccio) to prevent further downloads.\n\n**Long-term improvements:**\n- Enforce a dependency allowlist policy requiring security review and approval before any new third-party package is introduced into codebases.\n- Integrate software composition analysis (SCA) tools such as Snyk, Socket.dev, or OWASP Dependency-Check into CI\u002FCD pipelines to automatically flag suspicious or newly published packages.\n- Maintain a Software Bill of Materials (SBOM) for all projects to enable rapid identification and response when a malicious dependency is discovered.\n\n**Detection measures:**\n- Monitor runtime behavior of applications for unexpected shellcode execution, process injection, or anomalous outbound network connections originating from Node.js processes.\n- Subscribe to threat intelligence feeds and npm security advisories to receive timely alerts about newly identified malicious packages.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SSDF PW.4: Reuse Existing, Well-Secured Software","OWASP A06:2021 – Vulnerable and Outdated Components","SLSA Supply Chain Integrity Framework (Level 2+)","GDPR Article 32: Security of Processing (for EU-affected organizations handling user data)",{},"published","2026-10-17T12:20:17.185624+00:00","2026-10-17T12:20:17.17+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fmalfex-npm-package-imgdecode-hides.html","malfex-npm-package-imgdecode-hides-shellcode-loader-in-windows-native-addon-219fd9","MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[49],{"id":50,"date":51,"edition":52,"title":53,"audio_url":54},"5bfd8efd-bbf0-427e-a12e-8abbb056097d","2026-10-17","afternoon","ThreatNoir Weekend Brief — October 17","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-17\u002Fthreatnoir-afternoon-brief-2026-10-17.mp3",[56,59,63],{"slug":33,"name":57,"problem":58},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":60,"name":61,"problem":62},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]