imgdecode npm Is Malware: Check Your Lockfiles (2026)
You probably haven’t heard of imgdecode. It bills itself on npm as a “native image buffer decoder for Node.js build pipelines” — and as of today, October 17, 2026, you can still npm install it. But imgdecode doesn’t decode images. Per a SafeDep technical analysis published October 13, the imgdecode npm package is a malicious … Read more