OpenSSF/OSV advisory MAL-2026-12216 confirms this npm version as malicious. Package restricts itself to win32 and declares a postinstall hook ("postinstall": "node postinstall.js"). postinstall.js enumerates bin/*.exe and invokes execFileSync on the first entry, bin/ezfn.exe, with inherited stdio during npm install. The bundled 112 KB.NET PE has no source, no build step, and no documented purpose. String analysis of ezfn.exe shows remote-access-trojan capabilities: socket-based C2...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in stellarfix (npm)
Details
Package restricts itself to win32 and declares a postinstall hook ("postinstall": "node postinstall.js"). postinstall.js enumerates bin/*.exe and invokes execFileSync on the first entry, bin/ezfn.exe, with inherited stdio during npm install. The bundled 112 KB.NET PE has no source, no build step, and no documented purpose. String analysis of ezfn.exe shows remote-access-trojan capabilities: socket-based C2 (ClientSocket, BeginConnect, ConnectServer, ActivatePong), bot/chat identifiers (SendBot, ChatID), persistence configuration (InstallDir, InstallStr, LoggerPath), antivirus interference (Antivirus, Exclusion, ManagementQuery), symmetric encryption of C2 traffic (SymmetricAlgorithm, CreateDecryptor/CreateEncryptor, CipherMode), remote code retrieval (WebClient.DownloadString, WebRequest.Create), self-spreading (Spread), and webcam capture (avicap32.dll). Any Windows npm install of this package auto-runs the RAT and gives an external operator persistent remote control of the installer's host.
Decision reason
OpenSSF Malicious Packages via OSV confirms stellarfix@1.0.3 as malicious (MAL-2026-12216): Malicious code in stellarfix (npm)