Bad Dependencies: JPEGs, JavaScript, and Janky Malware: Image-Based Attacks in NPM

In the debut episode of Bad Dependencies, Charlie and Mackenzie unpack some seriously strange cases of malware hidden in plain sight on NPM. They explore how malicious actors are stuffing payloads into image files like JPEGs and PNGs, and how these are being unpacked with clever JavaScript tricks to evade detection.You'll hear how AI-generated decoy code, fake Readme files, and hidden PowerShell scripts are being used to disguise the true intent of packages — from base64 blobs in JPEGs to fake "fingerprinting" logic that serves no purpose other than distraction.Expect deep dives into packages like node-wave-http, axios-fingerprint, and expressjs-session, with behind-the-scenes insights on how attackers are setting the stage for future payload delivery. Plus, discover why Discord and Cloudflare are often abused for hosting malware — and what makes Windows such a popular target for these campaigns.If you've ever wondered how bad dependencies make it past package registry checks — or how to spot them — this episode is for you.00:00 - Welcome to Bad Dependencies01:10 - Hiding Malware in Images: NodeWave HTTP04:59 - Malicious JPEG Unpacks via PowerShell07:09 - Why Hackers Use Discord for Malware Delivery09:06 - Why NPM & GitHub Don’t Catch This Stuff11:00 - A Legit App or Malware Decoy? The OSU Twist12:34 - AI-Generated Code as Distraction Noise14:44 - Obscure Pre-flight Checks & Fake Logic17:09 - Alternate Payloads Hosted on Cloudflare22:00 - PNG with Base64-Encoded Eval Exploit26:30 - This Just Sends System Info: Bug Bounty Play?30:59 - Detecting Malware with Entropy Analysis