MALFEX npm Campaign and TensorLake 0.5.144 Put Installs at Risk
What changed · following since Oct 8 Oct 18 — MALFEX package imgdecode, uploaded September 30, 2026, had 979 downloads and used a Windows DLL to decrypt GitHub shellcode and inject it into dllhost.exe.
Two npm supply-chain paths now cover
Built from 5 signals across 3 sources · 293 items reviewed