MAL-2026-12216

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stellarfix/MAL-2026-12216.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12216
Published
2026-08-05T08:55:23Z
Modified
2026-08-05T16:51:09.872569279Z
Summary
Malicious code in stellarfix (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325)

stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and unconditionally launches the first one via execFileSync during npm install. The package.json declares scripts.postinstall=node postinstall.js, so the binary runs automatically on any Windows installer. The bundled binary contains class and P/Invoke symbols consistent with a full remote-access trojan: a ClientSocket/ConnectServer C2 channel with AES-encrypted traffic, an XLogger module using SetWindowsHookEx / LowLevelKeyboardProc / WM_KEYDOWN / ToUnicodeEx to capture keystrokes and GetForegroundWindow / GetActiveWindowTitle to capture focused-window context, a SendBot/ChatID exfiltration pipeline, ProcessCritical (SetCurrentProcessIsCritical) anti-termination, an Uninstaller routine, a USBSpread module (USBThread/USBStart/USBCode) for removable-media propagation, a Plugin loader, and OpenUrl/ReportWindow/Monitoring command handlers. The package contains no legitimate library code; its sole install-time effect is delivering and running this binary on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T09:28:15.971810552Z",
            "modified_time": "2026-08-05T08:55:23Z",
            "sha256": "304faa7930c5efaa4ff655a7ce779e977ce5b6b59c4c15154fc96c82fead9d16",
            "id": "IN-MAL-2026-014472",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector"
        },
        {
            "import_time": "2026-08-05T16:13:48.071063255Z",
            "sha256": "1e30554b98d24d905f55de80fb216bba2367d2259bdd251636eab19c8b19019a",
            "modified_time": "2026-08-05T15:54:30Z",
            "id": "IN-MAL-2026-015809",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T15:54:49Z",
            "sha256": "aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325",
            "id": "IN-MAL-2026-015810",
            "versions": [
                "1.0.4"
            ],
            "import_time": "2026-08-05T16:13:48.234246535Z"
        }
    ]
}
References
Credits

Affected packages

npm / stellarfix

Package

Name
stellarfix
View open source insights on deps.dev
Purl
pkg:npm/stellarfix

Affected ranges

Affected versions

1.*
1.0.0
1.0.3
1.0.4

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-+lDwKrTjV20AKigMfgX1dLIgrxJ2LXJTBVqYqOKvpPBbgxK98xZiIHh3wZdSC5xSu90qw9E8SLfnqNwKKBVfog==",
                "sha1": "58c5e44be7df120e8c87ab8de729abd5fe2475d3"
            },
            "filename": "stellarfix-1.0.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "3878c7eaaaaf854ab8d44f04bd7c6679d840a3a02ecb295cdbded6d5e779f00c",
            "tlsh": "a0e068d207da9b71a8b1c5c5ee7922b7294fc961730ab890c0ec4d89138319447d3aec"
        },
        {
            "path": "bin/ezfn.exe",
            "sha256": "418e262088eb5f3ba30cd456c775a607232d0d148c2aa20fe0e10433016cb681",
            "tlsh": "19b34b4efb458a08c15d0e778563658a82fac867e927f76f25cc1eda8d618ccc9cf484"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stellarfix/MAL-2026-12216.json"