SafeDep traced imgdecode to the MALFEX publisher cluster, which has been seeding Windows-targeting packages since August 2023.