Search — “MALFEX”

The brief item describes an npm package named imgdecode that conceals a Windows loader inside a native Node.js addon and pulls shellcode from GitHub. Defenders are told to check for a MicrosoftEdgeUpdateService scheduled task or service. The only linked source is an unrelated Hacker News article about identity exposure and attack paths, which contains no technical details of this campaign, so the technical claims rest solely on the brief.