SafeDep, a security firm, said the npm package imgdecode hides a loader in a compiled Node.js add-on, which a nine-line JavaScript file loads. Per SafeDep, when a program loads it from a Windows console, the library tries to fetch encrypted attack code from GitHub and runs it inside a new dllhost.exe process. SafeDep ties the package to MALFEX, a campaign Checkmarx and CloudSEK reported in early October. Version 1.0.3 came out on 2026-10-11. The package was still on npm on 2026-10-13, SafeDep said.
SafeDep could not recover banner.jpg, so what the loader downloads is unconfirmed. It calls the link to the MALFEX stealer an inference. SafeDep cited 929 downloads from 2026-09-30 to 2026-10-12. The Hacker News reported 979. SafeDep said the counts cannot separate people from automated tools, and the number of affected workstations is unknown.
Our reading, not SafeDep's finding: the package needs no install script and the code sits in a prebuilt binary, so checks that watch only install scripts have nothing to flag. SafeDep said the loader skips CI jobs and sandboxes, which redirect output. It advises treating any Windows workstation that loaded the package as possibly compromised. Leaders could ask: are developer workstations monitored, are prebuilt binaries in dependencies reviewed, and can credentials on Windows developer machines be rotated fast?