MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been...

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans RAT to compromised hosts. The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a...

MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data

CloudSEK uncovered the MALFEX campaign using malicious npm packages to deploy Overlord RAT, steal Discord and browser data,…...

Malicious code in malfex_api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf61c4d8d649d32458d1f89955b492660ca62652ac0c9410d9a9c07a54b3d546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...