More than 1,500 npm packages were exposed in a single week of the npm supply chain attack wave ending October 17, 2026 — and one of them, the MALFEX package 'imgdecode', hid a shellcode loader inside a Windows native addon that runs at install time. You don't even have to import the package. This free 60-second check scores the hygiene controls that decide whether your dependency tree can catch the next one. No signup, nothing installed.
Sources: The Hacker News — thehackernews.com (reported the imgdecode MALFEX package, Oct 17, 2026); npm docs — package-lock.json documentation.
Yes. More than 1,500 npm packages were exposed in a single week of October 2026, and the MALFEX package 'imgdecode' hid a shellcode loader inside a Windows native addon that runs at install time — before any code review can see it. Install scripts and compiled addons execute on install, so lockfiles, version pinning, and script-blocking are your real defense.
Answer honestly for the repo you deploy to production. Weighted scoring — native-addon and lockfile controls carry the most weight.
npm audit (or equivalent) on every PR and block on criticals?This page is an honest hygiene self-assessment, not a malware scanner. It cannot scan your node_modules for malicious code, cannot tell you whether a specific package version is compromised, and cannot replace npm audit, Socket, or a dedicated supply-chain scanner. It scores the controls that determine how exposed your tree is — nothing more.
npm install, long before any import statement is evaluated.^1.2.3 range plus no lockfile means next month's install may resolve to a version the attacker published yesterday.More than 1,500 npm packages were exposed in a single week ending October 17, 2026 — a wave of compromised, typosquat, and outright malicious packages reported across the ecosystem that week.
imgdecode is a MALFEX-labeled malicious npm package reported by The Hacker News on October 17, 2026. It hides a shellcode loader inside a Windows native addon, so the malicious code runs at install time — not when the package's JavaScript is imported.
A lockfile pins every dependency — direct and transitive — to an exact resolved version and integrity hash. Without one, a fresh install can silently pull a newer, compromised release published after your last good install.
No — and it says so honestly. This is a hygiene self-assessment, not a scanner. It scores the controls (lockfiles, pinning, audits, script-blocking) that determine how exposed your tree is; to scan installed code, use npm audit, Socket, or a dedicated supply-chain scanner.