Malicious npm Package “imgdecode” Serves as Shellcode Loader in Windows Native Addon
What Happened — Researchers identified a malicious npm package named imgdecode that embeds a Windows‑native addon capable of loading shellcode. The package was published on 30 Sept 2026, has been downloaded ≈ 979 times, and remains publicly available on npm. The code is part of the MALFEX supply‑chain campaign and is designed to execute arbitrary native payloads on compromised developer machines.
Why It Matters for Trust & Control Assurance
- Demonstrates how a third‑party dependency can become a covert execution vector, directly testing the third‑party risk management control objective.
- Continuous monitoring of software‑bill of materials (SBOM) and automated dependency scanning are the evidence streams needed to prove due diligence in an audit.
- A breach stemming from a malicious package would erode the defensible audit trail that control‑assurance programs rely on.
Who Is Affected – Organizations that develop or ship software using open‑source JavaScript libraries, across technology/SaaS, cloud infrastructure, fintech, and any sector that builds Node.js applications.
Recommended Actions
- Inventory all npm dependencies and generate an up‑to‑date SBOM for each product.
- Deploy automated scanning tools that flag newly published packages and detect known malicious patterns.
- Enforce a policy that blocks installation of packages without verified provenance or that fail security scans.
- Incorporate continuous third‑party risk monitoring into your control‑assurance dashboard to retain evidence for auditors.
Technical Notes – The malicious code is delivered via a native Node.js addon compiled for Windows, which loads shellcode at runtime. No CVE is associated because the issue resides in the malicious package itself, not a vulnerability in a legitimate product. Source: The Hacker News