Today’s Field Note

Three supply-and-protocol risks worth your attention. NEAR Intents published a postmortem tying a $3.8M exploit to a deposit notification bug (users made whole, notifications removed, a second critical bug already reported, so treat it as still-settling). Mark Karpelès reports Ledger hardware implants found in devices from two more resellers, and Ledger’s own authenticity check cannot detect the added hardware, which turns “buy from a reseller” into a seed-exposure event. Separately, the MALFEX npm package “imgdecode” (979 downloads, still live at writing) hides a Windows shellcode loader in a native addon, the kind of thing that ends up in a build pipeline and then in your signing machine. None of these are hypothetical.

Today’s Move

  • If you deposited into NEAR Intents, confirm your balance against the postmortem, withdraw to a wallet you control, and do not re-deposit until the second reported bug is resolved.
  • Only use Ledger devices bought direct from Ledger. For any device from a reseller or marketplace, assume physical compromise, move funds to a freshly initialized seed, and retire the old one.
  • Audit your npm dependencies for “imgdecode” and anything from publisher “malfexteste8”; purge it, rotate any credentials or signing keys touched by affected build hosts.
  • Builders: pin dependencies and run native addon builds in isolated, disposable environments, not on your signing or deploy machine.
  • Ignore and never interact with unsolicited airdropped tokens; receiving is harmless, interacting is the trap.

Resources

  • https://thedefiant.io/news/security/near-intents-postmortem-links-3-8-million-exploit-to-deposit-bug
  • https://thedefiant.io/news/security/karpel-s-reports-ledger-implants-in-devices-from-two-more-resellers
  • https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.