registry / img-to-native / 1.0.1

img-to-native@1.0.1

Convert image files to native binary representation for platform-specific rendering

AI Security Review

scanned 12d ago · by lpm-firewall-ai

On import, index.js waits for a hidden temp file, extracts data concealed after a PNG end marker, decrypts it with a hardcoded key, and writes an executable named node_runtime_helper.exe under a Microsoft Windows path.

Static reason

No blocking static signals were detected.

Trigger

Requiring the package, because package.json main points at index.js and the poller runs at module load.

Impact

A decrypted executable is planted in the user profile and the staging file is removed, giving a concealed dropper a persistent binary on disk.

Mechanism

The loader requires cdn-img-fetch, polls os.tmpdir for ._cif_data, base64-decodes and AES-256-CBC-decrypts the payload after IEND and //BIN//, writes it mode 0700, then deletes the temp file.

Attack narrative

Requiring img-to-native runs index.js at once. It loads cdn-img-fetch and polls the temp directory for up to two minutes for a file named ._cif_data. When that file appears, the code finds a PNG IEND marker, reads a following //BIN// section, base64-decodes it, and decrypts it with AES-256-CBC using the embedded key malfexteam2027. The plaintext is written as node_runtime_helper.exe under Microsoft/Windows in APPDATA or the home directory with mode 0700, and the staging file is deleted. Errors are ignored. The public image API only copies a file and does not gate this behavior.

AI rationale

Import of the published entrypoint is a dropper: it decrypts a concealed payload with a hardcoded key and writes an executable while deleting the staging file. The image-conversion API does not authorize or condition that behavior.

Evidence

index.jspackage.json._cif_dataMicrosoft/Windows/node_runtime_helper.exe

OSV advisory

On require() of img-to-native, index.js reads banner.jpg from the.cache directory of its sole dependency cdn-img-fetch, locates a payload appended after the PNG IEND marker, base64-decodes it, and AES-256-CBC decrypts it using a key derived from sha256('nif-runtime-2027'). The decrypted bytes are written to %LOCALAPPDATA%\Programs\NodeRuntime\node_runtime_helper.exe with mode 0o755, and the source image is then unlinked. An fs.watch fallback waits for the image to appear if it is not yet staged. The payload is obfuscated (hidden after a PNG end-of-image marker, base64-encoded, AES-encrypted), unverified (no hash or signature check), and dropped to a persistence-adjacent path with executable bits set. The advertised purpose ("convert image files to native binary representation") does not require decrypting content appended after a PNG IEND chunk to materialize a Windows executable. The companion package cdn-img-fetch is pinned as a caret range (^1.0.0), so future 1.x releases can silently change the delivered payload bytes. Installing or loading this package results in attacker-controlled code being written to the installer's filesystem with execute permission. ## Source: ghsa-malware (7131e9cb1bdeb272ae7e26f2877087fd5da8716ef7c08e0fc0bf1359e278df8e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

img-to-native@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code