Npm shipped a Windows shellcode loader inside a package that claimed to decode images.

Researchers following the MALFEX campaign found imgdecode, a module published to the npm registry on September 30, 2026 by an account named malfexteste8. The payload sits in a Windows native addon, a compiled binary your JavaScript linters will never parse. That is the cybersecurity failure hiding in your lockfile. The package logged 979 downloads and remained available after the reports landed. Your firewall didn’t inspect it. Your brute-force dashboards never saw it.

A native addon on Windows is usually a DLL wearing a .node filename. Threat detection teams hunt unsigned executables and odd PowerShell. They skip the binaries under node_modules. Attackers counted on that habit.

Dark Reading’s reporting on fake Claude and ChatGPT sites points at the same humans. ClickFix-style copy-and-paste lures now impersonate the AI tools your developers already live in.

The registry and the fake-AI lure are fishing the same installer culture.

The Addon Ran as Trusted Code

MALFEX needed a decoder-shaped name and one unreviewed install.

Native addons load as process memory your EDR already classified as node.exe doing Node things. Shellcode loaders thrive in that blind spot. The JavaScript stays boring. The binary does the work.

979 downloads won’t trend on GitHub. That count is plenty for a few Windows build agents, a contractor laptop, and a CI image nobody rebuilds because the pipeline is green. Supply chain operators harvest tokens, not headlines.

Threat-protection products on the perimeter still have a job. They’ll miss registry.npmjs.org delivering a .node file over TLS that matches every legitimate addon your app already pulls. Defense in depth that ends at the edge is a slide. Once the loader runs, incident response starts on a box that holds Git credentials, cloud CLIs, and kubeconfigs. That workstation is a privileged identity with a compiler attached.

Cybersecurity Still Treats npm as Plumbing

Most programs still file package managers under developer productivity. Cyber security budget goes to the firewall, the VPN, and the mailbox. The install path that actually executes unknown code on Windows build machines gets a wiki page and a shrug.

Fake Claude and ChatGPT sites make the same bet with less code. The victim pastes a “fix” into a terminal because that is how every doc site taught them to work. Developers paste commands for a living. Helpdesk staff do too.

You won’t lecture that reflex out of a workforce that ships on Friday.

Security hardening belongs on what the endpoint may execute. Allow-list publishers. Ban unsigned .node files on developer Windows images. Make CI refuse install scripts unless a named job opts in.

If a developer can pull arbitrary native addons, and a browser can talk them into running a ClickFix recipe, you are running two software distribution systems. Only one of them has a change ticket.

Download counts are a lousy reputation signal. Nine hundred pulls looks like someone else already vetted this. That is how a throwaway publisher like malfexteste8 gets into a production tree. Your private registry mirror will happily cache the poison and serve it faster than npm itself.

Windows is the tell. A native addon with a loader is aimed at developer laptops and the one Windows runner your Linux-heavy pipeline still keeps around for Electron or .NET steps. Hunt there first. Don’t wait for a Linux box to light up a detection you already tuned.

Pin Installs and Kill Native Execution

Treat every install as code execution, because that is what npm is.

Do this on the hosts that can reach production identity, not as a lunch-and-learn.

• Tonight: grep every lockfile, npm cache, and CI image for imgdecode and the malfexteste8 publisher. Isolate Windows hosts that installed anything from that account after September 30. Rotate Git, cloud, npm, and SSO tokens that lived on those boxes. Snapshot the disk before you reimage so incident response can hash the .node file and share the indicator.
• This week: set ignore-scripts as the CI default and allow lifecycle scripts only on named jobs. Block node-gyp and unsigned .node loads on developer Windows images unless a package sits on a written allow list. Turn on integrity pinning in lockfiles so a republish cannot swap the tarball under a familiar version.
• Always: egress-restrict build agents to the registries you actually use. Alert when a new .node file appears outside the allow list. Keep dropping inbound brute-force at the host with ipban-style fail2ban rules, and IPBan Pro if you already run it, because a quiet loader that needs more access often starts spraying credentials next.

Publisher allow lists sound painful until you count the hours of incident response on a developer laptop that had production AWS keys in the environment. Put the allow list in the golden image. Make pull requests the only way a new native addon enters the company. Review the binary, not the README.

You don’t need a new product category. You need a rule that unsigned native code from a public registry doesn’t execute on a machine that can reach production identity. Write it. Enforce it in the image.

The next MALFEX variant will have a prettier name.

Assume it is already in a sprint branch.

Sources

• MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
• Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk