MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

News

Technology & Digital Insights

The latest news, trends and insights on technology, artificial intelligence, cybersecurity, marketing and the digital world.

MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of

The Hacker News · October 17, 2026

OpenAI just wants to win

OpenAI has spent the last few years planting flags across the increasingly difficult terrain in mathematics. This week, it claimed one of its biggest prizes yet: a solution to a legendary Millennium Prize problem. In normal circumstances, this would have been celebrated as a historic achievement. Instead, many mathematicians have watched OpenAI's relentless advance with […]

Learning Sep 11, 2026

How to Connect to HMRC's Making Tax Digital API: A Beginner's Guide

If you write software for anyone who pays UK tax, sooner or later you'll need to talk to HMRC. Making Tax Digital (MTD) for Income Tax went live on 6 April 2026, and it's already mandatory for self-em

Security Sep 11, 2026

GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure

GitLab has released patches to address multiple flaws, including a maximum-severity security vulnerability that has witnessed in-the-wild probes within hours of public disclosure. The vulnerability in question is CVE-2026-85706 (CVSS score: 10.0), a path traversal issue in the repository commits API that could allow an unauthenticated user to read arbitrary files from the GitLab server under

Learning Sep 11, 2026

How to Prevent Race Conditions in Django

Let's say you have enough credit left to generate one more image in an AI app. You submit a request in one browser tab, then submit another in a second tab before the first finishes. The app accepts b

Learning Sep 11, 2026

Apple Watch’s New VO2 Max Test: How It Measures Your Cardiorespiratory Fitness

Your Apple Watch can tell you how fast you're moving, how your heart responds to exercise, and how your workout changes over time. But one of its more interesting fitness metrics is something it can't

Security Sep 11, 2026

Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks

Anthropic on Thursday said it identified and disrupted industrial-scale illicit distillation attacks against Claude from seven labs based in China, including Alibaba, Moonshot, DeepSeek, Z.ai (aka Zhipu), and MiniMax. Knowledge distillation by itself is a legitimate training method. It refers to a machine learning technique where a large, powerful AI model assumes the role of a "teacher" to

Learning Sep 11, 2026

How to Sandbox a Linux Process with Landlock, No Root Required

Here's a program restricting itself, then trying to read two files: without landlock: read /etc/hostname ok read /tmp/secret.txt ok with landlock, /etc allowed: read

Security Sep 11, 2026

Claude Used to Automate Exploitation and Data Theft Across Multiple Victims

Anthropic has warned that cybercriminals and state-sponsored hackers alike are using its Claude models for cyber attacks, weapons design, propaganda, and mass surveillance between December 2025 and August 2026. The threat actors, which the artificial intelligence (AI) company has branded Generative Threat Groups (GTGs), span state-sponsored groups, financially motivated criminals, commercial

Security Sep 11, 2026

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 (where "GTG" stands for Generative Threat Group), which aligns with broader reporting linking the cluster to Midnight

Marketing & SEO Sep 11, 2026

Google Analytics launches customizable Dashboards

Google Analytics has launched customizable Dashboards that bring key metrics and visualizations into one report.

Marketing & SEO Sep 11, 2026

Advertisers report Google Ads credits being revoked after spending

Advertisers report Google Ads promotional credits being invalidated after they’ve already spent budget to qualify for them.

Marketing & SEO Sep 11, 2026

TikTok rejects Meta ads pushing rivals to join child safety settlement

TikTok rejected Meta ads urging it and YouTube to join Meta’s multibillion-dollar child safety settlement with U.S. states.

Ready to build a better digital experience?

We create modern multilingual websites, integrate external services and automate content workflows for growing businesses.

Let’s discuss your project