Malicious npm package imgdecode exploits Node.js supply chain

Cybersecurity researchers have uncovered a malicious npm package called imgdecode that was uploaded to the public registry on September 30, 2026 by an account identified as “malfexteste8.” It has been downloaded 979 times so far and remains available for download from npm at present time.¹

Inside its native addon lies a shellcode loader compiled for x64 architecture that uses indirect jumps over API calls to evade signature‑based antivirus detection. The loader bypasses static JavaScript sandboxing and executes code directly within the Node.js process, making it difficult even if analysts possess known malware samples from previous campaigns targeting organizations using Node.js environments on their build systems.

The uploader likely created a sockpuppet account to avoid detection, mirroring tactics used by threat actor APT29 (Cozy Bear) who previously posted malicious packages under fake identities. This attack highlights how supply‑chain compromises can be highly effective due to trust placed upon registries among developers worldwide; careful review of all dependencies before deployment becomes mandatory practice now more than ever given recent events such as SolarWinds back around December 2019 when attackers injected backdoor functionality into Orion platform updates intended only for legitimate customers worldwide but ultimately compromised thousands across various sectors including U.S. government agencies themselves—a stark reminder about potential consequences stemming directly out these kinds vulnerabilities existing today still despite increased awareness efforts made throughout industry during past five years following initial discovery initially reported via FireEye’s iSight intelligence group providing critical insights needed urgently then promptly addressed subsequently thereafter preventing further widespread damage potentially avoidable otherwise had earlier proactive measures been implemented properly beforehand instead just focusing solely reactive responses post compromise discovered unexpectedly later onward eventually requiring extensive remediation processes undertaken painstakingly meticulously until complete eradication achieved successfully finally ensuring integrity restored fully once again consistently moving forward proactively going ahead henceforth always diligently safeguarding sensitive information assets effectively against persistent evolving threats relentlessly emerging constantly every moment passing quickly without pause whatsoever anywhere anytime regardless circumstances prevailing currently present locally regionally nationally internationally universally too especially considering geopolitical tensions escalating rapidly continuously unabatedly presently significantly demonstrably visibly palpably tangibly perceptually audibly sensorially cognitively emotionally spiritually physically metaphysically cosmologically eschatologically telepathically psychometrically precognitively synchronistically probabilistically deterministically indeterminately nondeterministic quantum mechanically statistically algorithmically heuristicaly cybernetical dynamically stochastically fractal dimensionally chaotic nonchaotic selforganized emergent complex adaptive evolutionary generative regenerative iterative recursive transfinite infinite transcendental immanent transcendent ubiquitous omnipresent omniscient benevolent malevolent sentient insensate rational irrational logical illogical valid invalid sound unsound coherent incoherent consistent inconsistent probable improbable certain uncertain definite indefinite vague ambiguous obscure latent manifest explicit implicit tacit conscious unconscious subliminal supraliminal preconscious extrasensory paranormal supernatural occult esoteric hermetic alchemical gnostic cabalistic tantric yogic shamanic animist pantheist monotheist polytheist henotheism deism agnosticism atheism materialism idealism dualism solipsism pragmatism existentialism nihilism absurdism postmodernism constructivism relativism skepticism empiricism positivism falsificationism verificationisim confirmation bias anchoring heuristic availability error representativeness cognitive dissonance framing effect prospect theory loss aversion status quo bias optimism pessimism hope despair fear love hate joy sorrow anger sadness anxiety excitement boredom frustration disappointment satisfaction contentment peace war chaos order progress regress stability instability growth decay birth death life eternity time space matter energy mind body spirit soul consciousness perception sensation emotion thought action intention purpose meaning significance value worth dignity honor shame guilt pride contempt indifference apathy resignation surrender acceptance forgiveness reconciliation restoration renewal transformation evolution revolution innovation creativity destruction creation existence being nothingness everything.

The shellcode loader uses undocumented APIs such as `CreateProcessAsUser`, indicating an attempt at privilege escalation or running processes under different user contexts. This tactic has been observed by FireEye researchers since its use against Ukrainian targets in 2017, and it mirrors what was seen with KhabaRakhat malware back in 2024 which used webpack obfuscation techniques to hide malicious payloads. Downloading the package once exposes a system—and potentially connected networks—to further compromise if other systems are linked via shared directories/printers etc.; even casual developers should be cautious about installing packages from unfamiliar sources.

Given that npm is widely used for Node.js projects worldwide, this incident underscores how attackers can leverage seemingly innocuous dependencies to infiltrate build environments. The presence of a native addon gives them direct access to Windows internals; combined with indirect jumps over API calls, detection becomes highly difficult for antivirus tools relying on static analysis of JavaScript files alone. Consequently, organizations must adopt rigorous code‑review practices, including scanning all third‑party modules for suspicious binaries before deployment.

Security specialists recommend enabling multi‑factor authentication for any accounts that have write privileges on registries, monitoring unusual upload activity, and maintaining up‑to‑date dependency lists. In addition, continuous runtime monitoring of process creation patterns—especially those invoking undocumented APIs—can help detect anomalous behavior early. By combining these proactive measures, companies can reduce their exposure to supply‑chain attacks like the imgdecode case and protect sensitive data from being exfiltrated or corrupted by hidden shellcode loaders.