Security researchers identified a malicious npm package named "imgdecode", part of a campaign called MALFEX, which had been downloaded 979 times, according to the source report.
Developers who installed the package should review their systems and rotate any credentials exposed.
Source: thehackernews.com, reported 10-17. https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html