MALFEX hides a shellcode loader inside an npm native addon that is still live

On October 17, 2026, SafeDep, Checkmarx and CloudSEK document the MALFEX campaign, which has been publishing npm packages since August 2023 whose nine-line JavaScript files load a DLL that injects shellcode into a Windows process. If your Windows machines install npm dependencies with native addons, audit your dependency trees and treat affected hosts as compromised.