registry / img-to-native / 1.0.0

img-to-native@1.0.0

Convert image files to native binary representation for platform-specific rendering

AI Security Review

scanned 12d ago · by lpm-firewall-ai

On import, index.js waits for a hidden temp file, decrypts a base64 AES payload appended after a PNG IEND marker and a //BIN// marker, and writes it as an executable.

Static reason

No blocking static signals were detected.

Trigger

Any require or import of the package main module index.js.

Impact

A disguised executable is planted on disk without the caller invoking the advertised image conversion. The source file is removed afterward.

Mechanism

A self-invoking poller checks os.tmpdir()/._cif_data up to 240 times. On a hit it decrypts with a hardcoded AES-256-CBC key, writes mode 0700 bytes to APPDATA or the home directory under Microsoft/Windows/node_runtime_helper.exe, and unlinks the temp file. Errors are swallowed.

Attack narrative

Loading img-to-native does not wait for toNative. It polls for two minutes for a dotfile in the temp directory. If that file contains data after a PNG end marker and a //BIN// marker, the module base64-decodes it, decrypts it with a fixed key labeled malfexteam2027, and writes the plaintext as node_runtime_helper.exe under a Microsoft Windows directory, then deletes the temp file. The published copy API is unrelated cover.

AI rationale

Import-time code hides an AES dropper behind an image-conversion API and plants a mode-0700 executable from a concealed temp payload. That is concrete malware behavior even though this file does not itself spawn the binary or open a network connection.

Evidence

index.jsos.tmpdir()/._cif_dataAPPDATA or homedir/Microsoft/Windows/node_runtime_helper.exe

OSV advisory

On require() of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended after the PNG IEND marker, base64-decodes it, and AES-256-CBC decrypts it using a key derived from sha256('nif-runtime-2027'). The decrypted bytes are written to %LOCALAPPDATA%\Programs\NodeRuntime\node_runtime_helper.exe with mode 0o755, and the source image is then unlinked. An fs.watch fallback waits for the image to appear if it is not yet staged. The payload is obfuscated (hidden after a PNG end-of-image marker, base64-encoded, AES-encrypted), unverified (no hash or signature check), and dropped to a persistence-adjacent path with executable bits set. The advertised purpose ("convert image files to native binary representation") does not require decrypting content appended after a PNG IEND chunk to materialize a Windows executable. The companion package cdn-img-fetch is pinned as a caret range (^1.0.0), so future 1.x releases can silently change the delivered payload bytes. Installing or loading this package results in attacker-controlled code being written to the installer's filesystem with execute permission. ## Source: ghsa-malware (7131e9cb1bdeb272ae7e26f2877087fd5da8716ef7c08e0fc0bf1359e278df8e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

img-to-native@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code