Researchers have identified a malicious npm package called “imgdecode” as part of a supply chain attack campaign named MALFEX. Uploaded on September 30, 2026, the package contains a Windows dynamic-link library that downloads encrypted shellcode from GitHub, decrypts it, and injects it into a new process when loaded. The package has been downloaded 979 times and remains available on npm. The MALFEX campaign, active since August 2023, has distributed eight malicious packages across five publisher accounts designed to compromise Windows systems through various infection methods.
The threat actor behind MALFEX has demonstrated responsiveness to public disclosures and npm removals by quickly publishing replacement packages. The malware performs anti-analysis checks and harvests sensitive files, cryptocurrency wallet information, and data from web browsers and gaming applications. It also establishes command-and-control connections enabling shell execution, file transfers, and system monitoring. Developers who installed these packages should immediately isolate affected Windows systems, check for persistence mechanisms, rotate credentials, and move cryptocurrency to new wallets if seed phrases were compromised.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
