The MALFEX npm Attack: What EU Developers Need to Know

The Short Version

A package called imgdecode was published to npm on September 30, 2026. It claims to decode images. It actually installs a shellcode loader inside a Windows native addon. Researchers have linked it to a supply chain campaign called MALFEX. If your team installed it in the last two weeks, you need to check your dependency tree now.

This is not a hypothetical. Supply chain attacks like SolarWinds and SolarWinds-adjacent incidents have already proven the pattern: you trust your package manager, the attacker hijacks that trust. The MALFEX campaign uses the same playbook — a small, seemingly useful utility that hides malicious native code.

What Happened

The package imgdecode was published under a user account that is now associated with the MALFEX campaign. It was designed to look like a legitimate image-processing utility. On inspection, it contains a Windows native addon — a compiled .node file — that drops a shellcode loader onto the target system. Shellcode loaders are the first stage of a broader attack chain: they download and execute whatever the attacker wants next, whether that’s ransomware, a backdoor, or data exfiltration tooling.

The package was not widely starred or forked. It gained traction through automated tooling and copy-paste dependency installation — the exact scenario where a developer runs npm install imgdecode without checking who maintains it.

Why This Matters to Your Business

Most companies under 200 employees don’t have a software composition analysis (SCA) tool scanning every dependency. They rely on developers to choose packages, and developers choose packages based on convenience, not security audits. That gap is exactly what MALFEX exploits.

If the package was pulled into your codebase — even in a dev dependency or a build script — the shellcode loader could execute on any developer machine or CI/CD pipeline running Windows. From there, lateral movement to production infrastructure is a matter of stolen credentials and privilege escalation.

How to Check If You’re Affected

1. Search your lock files. Run grep -r "imgdecode" package-lock.json yarn.lock pnpm-lock.yaml in your repositories. If it appears, trace where it came from.

2. Check install logs. Review CI/CD logs for any npm install imgdecode or transitive dependencies that pulled it in.

3. Audit your node_modules. Look for unexpected .node files in directories you didn’t expect.

4. Rotate credentials. If you can’t confirm the package was never installed, assume the worst and rotate any credentials that touched the affected environment.

Preventing the Next One

Policy: Only install packages from maintainers with a track record and two-factor authentication enabled. npm now shows maintainer status — require it.

Tooling: Deploy npm audit in CI. Better yet, use a tool like Snyk, Dependabot, or Socket (by Supabase) that flags anomalous package behavior before it reaches your codebase.

EU compliance note: Under NIS2 (which entered application this year for many EU sectors), a supply chain compromise that leads to service disruption can trigger reporting obligations. The directive’s scope covers digital service providers and their supply chains. If you’re in scope, detecting and containing this kind of compromise isn’t just good practice — it’s a legal requirement.

What I Tell My vCISO Clients

“You don’t need to trust every package. You need a process that makes trust verifiable.”

The MALFEX campaign succeeded because it looked harmless. The defense is simple but not easy: treat your dependency tree like your network perimeter. Every external package is a border crossing. Inspect what enters.

I recommend every client I work with implements three controls:

1. Allow-list of approved packages — not a deny-list of known-bad ones
2. Automated SCA scanning in CI/CD — block merges that introduce high-risk packages
3. Quarterly dependency audits — human review, not just automated scanning

Bottom Line

The imgdecode package is a reminder that the software supply chain is the new attack surface. Your developers are installing dozens of packages a month. If you can’t track them, you can’t defend them.

If you’re an EU-based business under 200 employees and you don’t have a process for vetting dependencies, book a review. We’ll audit your current stack and put basic controls in place before the next campaign shows up.