MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
- ID
- 36583
- Status
- summarized
- Published
- 17 Oct 2026, 7:11 PM
- Fetched
- 17 Oct 2026, 9:23 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 17 Oct 2026, 9:24 PM
- Tags
- Audience
- developersvibe_coders
What happened
The Hacker News reports on an npm package named 'imgdecode' that ships a shellcode loader hidden inside a Windows native addon, tracked under the name MALFEX. The supplied article text is truncated to the headline and site navigation, so it contains no version numbers, download counts, discovery dates, or attribution details to work from.
Why it matters
The only concrete technical fact available is the delivery mechanism: the payload lives in a Windows native addon rather than JavaScript, so reading the package's JS source or running a typical source-level review will not surface it. If any part of your install or CI pipeline runs on Windows, treat compiled .node binaries in npm dependencies as opaque executables you are choosing to trust — pinning and lockfile review only help if someone actually inspects the binary.
Discussion angle
Vibe-coded projects pull in packages fast; walk through what your tooling actually catches versus what it cannot — specifically, whether anyone on the team would ever notice a malicious compiled native addon before it runs on a Windows machine.