MAL-2026-12190

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/retracfix/MAL-2026-12190.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12190
Published
2026-08-05T08:55:31Z
Modified
2026-08-05T10:06:14.400221430Z
Summary
Malicious code in retracfix (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4)

The npm package retracfix@1.0.0 ships with no documented functionality (empty description, no README, no source, no dependencies) and consists only of postinstall.js plus a single Windows PE at bin/ezfn.exe. package.json declares scripts.postinstall='node postinstall.js' and os=['win32']; postinstall.js enumerates bin/ for any.exe and unconditionally runs it via execFileSync on Windows installs. The bundled ezfn.exe is a.NET assembly whose metadata contains the type/member signatures of a remote-control agent and infostealer: ClientSocket / ConnectServer / BeginConnect / isConnected / ActivatePong for a C2 socket; SendBot / ChatID plus WebClient.DownloadString for a Telegram-bot exfil/command channel; ManagementObjectSearcher with the strings 'Antivirus' and 'Exclusion' for AV enumeration and Defender-exclusion registration; avicap32.dll for webcam capture; Microsoft.Win32 RegistryKey / CurrentUser Run-key persistence; WindowsIdentity/WindowsPrincipal privilege checks; SymmetricAlgorithm CreateEncryptor/Decryptor, WriteAllBytes, GetTempPath, InstallDir/InstallStr/LoggerPath; and a 'Spread' routine. The package name plus the binary name 'ezfn' (Easy Fortnite) fit a gaming-cheat lure. Running npm install retracfix on Windows drops and launches this binary, handing persistent remote control of the installer's host to the operator.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:16.487449112Z",
            "modified_time": "2026-08-05T08:56:01Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014476",
            "sha256": "15feec56f800e0a120a9d99df2755c5ed5a92c42a0a0f4207bcb6304ae8a9fee"
        },
        {
            "sha256": "7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2026-08-05T08:55:31Z",
            "id": "IN-MAL-2026-014473",
            "import_time": "2026-08-05T09:28:16.186108471Z"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T08:55:40Z",
            "versions": [
                "1.0.3"
            ],
            "sha256": "686e52b984e09e4bae909382a250db5acc1eda2e48a24c6af0083d15fdd82983",
            "id": "IN-MAL-2026-014474",
            "import_time": "2026-08-05T09:28:16.273395321Z"
        }
    ]
}
References
Credits

Affected packages

npm / retracfix

Package

Name
retracfix
View open source insights on deps.dev
Purl
pkg:npm/retracfix

Affected ranges

Affected versions

1.*
1.0.0
1.0.1
1.0.3

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/retracfix/MAL-2026-12190.json"
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "037f7cd6f40e0baf8de373c00d29f9f238e5f51cd2e9f92d10554dd7dd49225b",
            "tlsh": "6cf0dd804eeb5a2a55b140c1ff2d21372c4f8c20b30df060c1ac864857410ac95db7c9"
        },
        {
            "path": "bin/ezfn.exe",
            "sha256": "418e262088eb5f3ba30cd456c775a607232d0d148c2aa20fe0e10433016cb681",
            "tlsh": "19b34b4efb458a08c15d0e778563658a82fac867e927f76f25cc1eda8d618ccc9cf484"
        },
        {
            "path": "package.json",
            "sha256": "def974d2ced7714fdc59caa9d12e02c79c914a8a9c1c41542bd0e24451747f02",
            "tlsh": "0ad01200c8614f3278d87fad0c27909da5310d4b44853d2963db698c4b5a6ba98bf27a"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "4a4d860866920cfe8563f7e05bbd1b5525d18762",
                "sha512_sri": "sha512-FcNaQUzZWm/kszSRHxT1PtxKiZU0tnXGJK4wd+VMFcKKZ90dkdtlf4J/U+Np1E8fgr19+XF4wpmMffd/gfl5FQ=="
            },
            "filename": "retracfix-1.0.1.tgz"
        }
    ]
}