SecurityThe Hacker Newsabout 3 hours ago
Malicious npm Package Hides Shellcode Loader
5 min read
Cybersecurity researchers discovered the malicious npm package 'imgdecode' on September 30, 2026, which hides a shellcode loader in a Windows native addon. Uploaded by user malfexteste8, the package was downloaded 979 times and remains available. It decrypts encrypted shellcode from GitHub and injects it into a new dllhost.exe process, targeting Windows systems as part of the MALFEX campaign.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyMicrosoft
