Malicious npm Package 'imgdecode' Used in MALFEX Supply-Chain Attack Targets Windows Add-On

Cybersecurity researchers have uncovered a malicious npm package called “imgdecode” that is part of the recently disclosed MALFEX software supply-chain attack campaign. The package was published to the public npm registry on 30 September 2026 by a user identified as “malfexteste8” and, despite its malicious intent, has been downloaded 979 times to date.

The imgdecode module is a Windows native addon that embeds a shellcode loader, allowing an attacker to execute arbitrary code on any system that installs the package. Once the malicious code runs, it can download additional payloads, establish persistence, and potentially move laterally within a network, mirroring techniques seen in other supply-chain compromises.

While the package targets Windows environments, its presence in the npm ecosystem means any Node.js application that depends on it—directly or through transitive dependencies—could be compromised. Many Australian small- and medium-size enterprises rely on Node.js for internal tools, web services, and SaaS solutions, making this a concrete risk for local businesses that may not have dedicated security teams.

The Australian Cyber Security Centre advises organisations to adopt a software‑bill‑of‑materials (SBOM) approach, regularly audit third‑party libraries, and enforce strict version‑control policies. Administrators should immediately search for the imgdecode package in their codebases, remove it, and run a full malware scan on affected hosts. Enabling multi‑factor authentication and network segmentation can also limit the impact of any potential breach.

To help businesses and IT professionals stay ahead of such threats, Wepro Technology offers cybersecurity awareness and defensive coding workshops, including training on supply‑chain security best practices and preparation for certifications such as CEH and upcoming pentesting courses.