MAL-2026-12216
Malicious code in stellarfix (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (304faa7930c5efaa4ff655a7ce779e977ce5b6b59c4c15154fc96c82fead9d16) Package restricts itself to win32 and declares a postinstall hook ("postinstall": "node postinstall.js"). postinstall.js enumerates bin/*.exe and invokes execFileSync on the first entry, bin/ezfn.exe, with inherited stdio during npm install. The bundled 112 KB.NET PE has no source, no build step, and no documented purpose. String analysis of ezfn.exe shows remote-access-trojan capabilities: socket-based C2 (ClientSocket, BeginConnect, ConnectServer, ActivatePong), bot/chat identifiers (SendBot, ChatID), persistence configuration (InstallDir, InstallStr, LoggerPath), antivirus interference (Antivirus, Exclusion, ManagementQuery), symmetric encryption of C2 traffic (SymmetricAlgorithm, CreateDecryptor/CreateEncryptor, CipherMode), remote code retrieval (WebClient.DownloadString, WebRequest.Create), self-spreading (Spread), and webcam capture (avicap32.dll). Any Windows npm install of this package auto-runs the RAT and gives an external operator persistent remote control of the installer's host.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for stellarfix (npm). Pin to a known-safe version or switch to an alternative.