stellarfixer
This report shows the evidence for stellarfixer@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe lifecycle script directly executes a Windows binary whose embedded .NET metadata describes multiple concrete malware capabilities. No legitimate package functionality is present to justify this behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Potential keylogging, C2 control, persistence, USB propagation, and DDoS activity.
Mechanism
postinstall launches bundled Windows .NET malware
Attack narrative
npm installation invokes postinstall.js, which enumerates bin/ and synchronously launches stellarfn.exe. Static inspection of that .NET binary identifies low-level keyboard hook APIs, XLogger, socket connection and command-handling classes, registry/startup APIs, USB propagation, DDoS, AES encryption, and critical-process support. This is an unconsented install-time execution chain for a bundled RAT-style payload.
AI rationale
The lifecycle script directly executes a Windows binary whose embedded .NET metadata describes multiple concrete malware capabilities. No legitimate package functionality is present to justify this behavior.
Evidence
package.jsonpostinstall.jsbin/stellarfn.exe
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json postinstall runs node postinstall.js
- postinstall.js executes bin/stellarfn.exe during install
- bin/stellarfn.exe is a Windows .NET executable
- Binary exposes low-level keyboard-hook APIs and XLogger
- Binary strings show socket C2, USB spreading, DDoS, and critical-process code
- Binary includes registry/startup-related APIs
Evidence against
- No concrete URL or host is embedded in readable strings
Behavioral surface
ChildProcessFilesystem
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgbin/stellarfn.exeView file
•path = bin/stellarfn.exe
kind = native_binary
sizeBytes = 46080
magicHex = [redacted]
Medium
Findings
1 High3 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumShips Native Binarybin/stellarfn.exe
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License
Affected versions and remediation
This report applies to stellarfixer@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing stellarfixer@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.