A decompression stub is the built-in program inside a self-extracting archive (SFX) that unpacks the embedded files and then launches them. It is the execution wrapper for the package, so it controls what happens before the user ever sees the extracted content.
In cyber security, the stub matters because attackers can modify it to add malicious logic while the archive still looks like a normal installer. That can hide code in the unpacking process, evade simple file inspections, and even support memory-based execution through reflective loaders. Defenders therefore look beyond the visible payload and compare the stub against trusted baselines, analyze behavior, and inspect memory and execution flow, not just the archive contents.