Cyber Attacks
1.0.3 imgdecode npm package hosts hidden shellcode loader, 979 downloads, still online
The imgdecode package, version 1.0.3, hides a shellcode loader in a Windows addon. The package remains available on npm with no confirmed removal.
supply chain
Everything Patch Herald has reported about supply chain: 2 stories, newest first. Part of our Malware & Ransomware coverage.
Malware & Ransomware
Warning Signs of Malicious npm Packages in Your Project
Obfuscated code and sudden dependency shifts often hide inside packages long before any alert triggers, bypassing standard signature-based detection methods.