October 19, 2026
- MALFEX returned with a native-addon shellcode loader on npm. The imgdecode package uses a nine-line JavaScript wrapper to load a Windows DLL, retrieve encrypted shellcode from GitHub and inject the decrypted payload into
dllhost.exe. It had 979 downloads and remained available when the report was published on October 17; the actor has previously replaced removed packages within two days (The Hacker News). · Threat Activity & Supply Chain
in AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts