Malicious npm Package Discovered Executing Windows Shellcode Injection Campaign

Cybersecurity researchers discovered a malicious npm package that forms part of a supply chain attack campaign known as MALFEX, The Hacker News reported. The package, named imgdecode, was uploaded to the npm registry on September 30, 2026, by an account named malfexteste8. It has accumulated 979 downloads and remains available on the repository in version 1.0.3. [1]

According to The Hacker News, the malicious package relies on a Windows dynamic link library to execute its secondary stage. The dynamic link library retrieves an encrypted payload hosted on GitHub, decrypts the contents, and injects the resulting shellcode directly into the legitimate Windows process dllhost.exe. [1]

Microsoft Windows hosts system utilities such as dllhost.exe to execute component object model services, while software like Notepad++ and operating systems like Windows 7 also run within the broader Microsoft Windows environment. [1][2][3]

The discovery highlights ongoing risks within JavaScript package registries where natively compiled addons can evade standard static analysis. Security teams are advised to audit dependencies for unauthorized packages linked to the MALFEX campaign. [1]