registry / stellarfixer / 1.0.0

stellarfixer@1.0.0

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installing the package runs a bundled native executable without user action. The executable exposes concrete surveillance, persistence, and remote-control capabilities.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Potential keylogging, C2 control, persistence, USB propagation, and DDoS activity.

Mechanism

postinstall launches bundled Windows .NET malware

Attack narrative

npm installation invokes postinstall.js, which enumerates bin/ and synchronously launches stellarfn.exe. Static inspection of that .NET binary identifies low-level keyboard hook APIs, XLogger, socket connection and command-handling classes, registry/startup APIs, USB propagation, DDoS, AES encryption, and critical-process support. This is an unconsented install-time execution chain for a bundled RAT-style payload.

Rationale

The lifecycle script directly executes a Windows binary whose embedded .NET metadata describes multiple concrete malware capabilities. No legitimate package functionality is present to justify this behavior.

Evidence

package.jsonpostinstall.jsbin/stellarfn.exe

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13353

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in stellarfixer (npm)

Details

On npm install, the package's postinstall script unconditionally executes a bundled Windows PE at bin/stellarfn.exe via execFileSync. The binary is a.NET remote-access trojan: it opens a socket-based C2 channel (ClientSocket/BeginConnect/ConnectServer, SendMSG, SendBot/ChatID) with plugin loading (WriteAllBytes/ReadAllBytes), installs a low-level keyboard hook (SetWindowsHookEx + WH_KEYBOARD_LL + LowLevelKeyboardProc + ToUnicodeEx) tagged with active-window titles (GetForegroundWindow/GetActiveWindowTitle) for system-wide credential-grade keystroke capture, captures webcam frames (capCreateCaptureWindowA/capGetDriverDescriptionA), propagates to removable drives (USBThread/USBStart/USBSpread/RunDisk), and includes AV-exclusion, SetCurrentProcessIsCritical anti-kill, AES payload encryption, and an uninstaller. Installing this package on a Windows host results in immediate full-host compromise, remote attacker control, credential theft, and worm-like USB propagation.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json postinstall runs node postinstall.js
postinstall.js executes bin/stellarfn.exe during install
bin/stellarfn.exe is a Windows .NET executable
Binary exposes low-level keyboard-hook APIs and XLogger
Binary strings show socket C2, USB spreading, DDoS, and critical-process code
Binary includes registry/startup-related APIs

Evidence against

No concrete URL or host is embedded in readable strings

Behavioral surface

Source

ChildProcessFilesystem

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 387 B of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/stellarfn.exeView file

•path = bin/stellarfn.exe kind = native_binary sizeBytes = 46080 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/stellarfn.exeView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/stellarfn.exeView file

•path = bin/stellarfn.exe kind = native_binary sizeBytes = 46080 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/stellarfn.exeView on unpkg

Findings

1 High3 Medium3 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumShips Native Binarybin/stellarfn.exe

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowNo License