MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Summary
Cybersecurity researchers have identified a malicious npm package named "imgdecode" that is part of the MALFEX software supply chain attack campaign. This package, uploaded by a user named "malfexteste8," contains shellcode loader hidden within a Windows native addon and has been downloaded nearly 1000 times.
IFF Assessment
The discovery of a malicious npm package used in a supply chain attack indicates a new threat vector and means defenders must be vigilant against compromised packages.
Defender Context
This incident highlights the persistent threat of software supply chain attacks, where malicious code is injected into legitimate software repositories. Defenders should prioritize robust package validation, dependency scanning, and maintain strict policies on the use of third-party code to mitigate risks.