MAL-2026-13353

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stellarfixer/MAL-2026-13353.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13353
Published
2026-08-05T15:55:02Z
Modified
2026-08-05T16:51:10.083331303Z
Summary
Malicious code in stellarfixer (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bd3a96aa989ed6cadd106e8e7d04317ea30f83434a40eabc307578cb0690b78f)

On npm install, the package's postinstall script unconditionally executes a bundled Windows PE at bin/stellarfn.exe via execFileSync. The binary is a.NET remote-access trojan: it opens a socket-based C2 channel (ClientSocket/BeginConnect/ConnectServer, SendMSG, SendBot/ChatID) with plugin loading (WriteAllBytes/ReadAllBytes), installs a low-level keyboard hook (SetWindowsHookEx + WHKEYBOARDLL + LowLevelKeyboardProc + ToUnicodeEx) tagged with active-window titles (GetForegroundWindow/GetActiveWindowTitle) for system-wide credential-grade keystroke capture, captures webcam frames (capCreateCaptureWindowA/capGetDriverDescriptionA), propagates to removable drives (USBThread/USBStart/USBSpread/RunDisk), and includes AV-exclusion, SetCurrentProcessIsCritical anti-kill, AES payload encryption, and an uninstaller. Installing this package on a Windows host results in immediate full-host compromise, remote attacker control, credential theft, and worm-like USB propagation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-015811",
            "import_time": "2026-08-05T16:13:48.524236928Z",
            "sha256": "bd3a96aa989ed6cadd106e8e7d04317ea30f83434a40eabc307578cb0690b78f",
            "modified_time": "2026-08-05T15:55:02Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / stellarfixer

Package

Name
stellarfixer
View open source insights on deps.dev
Purl
pkg:npm/stellarfixer

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Q6tEM3WvyHRujsUR9QvoYuYcQfow7meKEgKGKH1AqyTBmulNjK+NyqKQ4FKo6MSh/cjqt2GdeWnS7JpB9bEvYw==",
                "sha1": "9edacaebdae8d12d02bf06d7293a230721eece8e"
            },
            "filename": "stellarfixer-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "3878c7eaaaaf854ab8d44f04bd7c6679d840a3a02ecb295cdbded6d5e779f00c",
            "tlsh": "a0e068d207da9b71a8b1c5c5ee7922b7294fc961730ab890c0ec4d89138319447d3aec"
        },
        {
            "path": "bin/stellarfn.exe",
            "sha256": "ba14d64eb4748850b0496d1db673156772add91215372c96271b03fa1b4d8617",
            "tlsh": "aa233c087bd44610e9feabf51db2a2064732ba079a13d74d0cd5979f1f2b6c0ce417a6"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/stellarfixer/MAL-2026-13353.json"