Malicious npm Package 'imgdecode' Discovered as Part of MALFEX Supply Chain Campaign

Cybersecurity researchers have identified a malicious npm package named "imgdecode" as part of a broader software supply chain attack campaign dubbed MALFEX, according to The Hacker News. The package was uploaded to the npm registry on 30 September 2026 by an account named "malfexteste8" and had been downloaded approximately 979 times at the time of reporting. The package conceals a shellcode loader within a Windows native addon — a component that sits outside the standard JavaScript layer of an npm package — making the malicious payload significantly harder to detect through conventional code review or basic automated scanning. The package remained available on npm at the time of publication.

Why this matters for UK organisations

The npm ecosystem is one of the most widely used open-source package registries in the world, and it is a routine dependency source for development teams across UK organisations of all sizes — from large enterprises to small software houses and internal development functions. Supply chain attacks via malicious packages are an established and growing technique: by exploiting the trust developers place in open-source registries, attackers can introduce malicious code into software builds, CI/CD pipelines or developer workstations without needing to compromise the organisation directly. The decision to hide the payload within a Windows native addon is technically deliberate: many automated scanning tools focus on JavaScript-level analysis and may not inspect compiled native components with the same depth. With nearly 1,000 downloads in under three weeks, the potential for widespread exposure across development environments is real, and the downstream risk to any software built using the package could extend to production systems and end users.

What to review

UK development teams should check whether "imgdecode" appears in any of their project dependency trees and remove it immediately if found. More broadly, this incident is a prompt to review the maturity of your software supply chain security practices. Consider whether your teams are using tools that scan npm packages against known malicious package databases, whether your CI/CD pipeline enforces integrity checks — such as package lock files and checksum verification — on third-party dependencies, and whether developers have clear guidance on evaluating the provenance and legitimacy of packages before adding them to a project. Using a private package registry with vetted and approved packages, and locking dependency versions to prevent unexpected updates, are practical steps that can meaningfully reduce exposure to this type of attack.

Source: The Hacker News