/
malware_families:MALFEX × victim_sectors:cryptocurrency × limpar

Resultados

2 casos · pág. 1/1

thehackernews.com · high

MALFEX npm campaign: 'imgdecode' package hides shellcode loader in Windows native addon, delivers Node.js stealer/RAT

Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …

technology software development
safedep.io · high

MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …

MALFEX software development cryptocurrency