MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
The Hacker News published a report titled "MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon." According to the headline, the package is named 'imgdecode' and is associated with a campaign or activity cluster referred to as MALFEX. The report states that the package conceals a shellcode loader within a Windows native addon, meaning the malicious component is described as a native binary rather than plain JavaScript. The source text supplied for this item consists of the headline and embedded font styling from the article page; the body of the report is not included. As a result, details such as the package's version history, download counts, publication dates, the identity of the discoverer, the specific shellcode or payload involved, and any stated response from npm or the maintainers are not available in the excerpt. The digest is therefore limited to what the headline asserts: an npm package called 'imgdecode' was reported to hide a shellcode loader in a Windows native addon under the MALFEX label.
The report indicates a published npm package, 'imgdecode', concealed a shellcode loader in a Windows native addon, a component type that JavaScript-focused review may not inspect.