- Published
- Source
- The Hacker News
- Filed under
- Microsoft, Malware & exploits
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of…
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Supply Chain Compromise
Initial AccessWhat a defender checks
- Find where the affected package, update or vendor is used in your estate.
- Pin and verify dependencies, and keep a software bill of materials.
- Review what access the vendor's software has.
Build the skillBlue Team Engineer · Risk Assessment & Recommendations Reporting
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Microsoft SC-200 exam training
Defender and Sentinel in the headlines? That's the SC-200 toolkit.
Tutor-led SC-200 preparation: running security operations in Microsoft Sentinel and Defender XDR, responding to incidents across identity, endpoint, email and cloud, and threat hunting with KQL.
- Microsoft Sentinel and Defender XDR
- Incident response across Microsoft 365
- Threat hunting with KQL
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.
