Security
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The Hacker News·October 17, 2026·1 min read
Cybersecurity researchers discovered a malicious npm package named 'imgdecode' as part of the MALFEX software supply chain attack campaign. Uploaded on September 30, 2026, by user 'malfexteste8,' it hides a shellcode loader in a Windows native addon. The package has been downloaded 979 times and remains available on npm, posing an ongoing risk to developers.
Read at The Hacker NewsDaily crypto arcade
Read the news, then play it.
Chainshorts turns crypto headlines into a daily game. Catch up in 60 words, then jump into daily lucky draws for a shot at the pot.