MAL-2026-12216
Malicious code in stellarfix (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (304faa7930c5efaa4ff655a7ce779e977ce5b6b59c4c15154fc96c82fead9d16) Package restricts itself to win32 and declares a postinstall hook ("postinstall": "node postinstall.js"). postinstall.js enumerates bin/*.exe and invokes execFileSync on the first entry, bin/ezfn.exe, with inherited stdio during npm install. The bundled 112 KB.NET PE has no source, no build step, and no documented purpose. String analysis of ezfn.exe shows remote-access-trojan capabilities: socket-based C2 (ClientSocket, BeginConnect, ConnectServer, ActivatePong), bot/chat identifiers (SendBot, ChatID), persistence configuration (InstallDir, InstallStr, LoggerPath), antivirus interference (Antivirus, Exclusion, ManagementQuery), symmetric encryption of C2 traffic (SymmetricAlgorithm, CreateDecryptor/CreateEncryptor, CipherMode), remote code retrieval (WebClient.DownloadString, WebRequest.Create), self-spreading (Spread), and webcam capture (avicap32.dll). Any Windows npm install of this package auto-runs the RAT and gives an external operator persistent remote control of the installer's host.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for stellarfix (npm). Pin to a known-safe version or switch to an alternative.