The npm package 'imgdecode' versions 1.0.0 through 1.0.3 contains malicious code disguised as a native image buffer decoder. It includes a packed and obfuscated Windows PE binary that executes native code immediately upon module load on Windows x64 hosts. The package's JavaScript interface does not match its advertised API, indicating it is a facade for delivering malicious payloads. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated from a separate, clean device.