stellarfix

{"schema_version":"1.7.4","id":"MAL-2026-12216","published":"2026-08-05T08:55:23Z","modified":"2026-08-05T16:16:05.004704857Z","summary":"Malicious code in stellarfix (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325)\nstellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and unconditionally launches the first one via execFileSync during npm install. The package.json declares scripts.postinstall=node postinstall.js, so the binary runs automatically on any Windows installer. The bundled binary contains class and P/Invoke symbols consistent with a full remote-access trojan: a ClientSocket/ConnectServer C2 channel with AES-encrypted traffic, an XLogger module using SetWindowsHookEx / LowLevelKeyboardProc / WM_KEYDOWN / ToUnicodeEx to capture keystrokes and GetForegroundWindow / GetActiveWindowTitle to capture focused-window context, a SendBot/ChatID exfiltration pipeline, ProcessCritical (SetCurrentProcessIsCritical) anti-termination, an Uninstaller routine, a USBSpread module (USBThread/USBStart/USBCode) for removable-media propagation, a Plugin loader, and OpenUrl/ReportWindow/Monitoring command handlers. The package contains no legitimate library code; its sole install-time effect is delivering and running this binary on the installer's host.\n","affected":[{"package":{"name":"stellarfix","ecosystem":"npm"},"versions":["1.0.3","1.0.0","1.0.4"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"3878c7eaaaaf854ab8d44f04bd7c6679d840a3a02ecb295cdbded6d5e779f00c","tlsh":"a0e068d207da9b71a8b1c5c5ee7922b7294fc961730ab890c0ec4d89138319447d3aec"},{"path":"bin/ezfn.exe","sha256":"418e262088eb5f3ba30cd456c775a607232d0d148c2aa20fe0e10433016cb681","tlsh":"19b34b4efb458a08c15d0e778563658a82fac867e927f76f25cc1eda8d618ccc9cf484"}],"package_integrity":[{"filename":"stellarfix-1.0.3.tgz","hashes":{"sha1":"58c5e44be7df120e8c87ab8de729abd5fe2475d3","sha512_sri":"sha512-+lDwKrTjV20AKigMfgX1dLIgrxJ2LXJTBVqYqOKvpPBbgxK98xZiIHh3wZdSC5xSu90qw9E8SLfnqNwKKBVfog=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/stellarfix/v/1.0.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/stellarfix/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/stellarfix/v/1.0.4"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014472","import_time":"2026-08-05T09:28:15.971810552Z","modified_time":"2026-08-05T08:55:23Z","sha256":"304faa7930c5efaa4ff655a7ce779e977ce5b6b59c4c15154fc96c82fead9d16","source":"amazon-inspector","versions":["1.0.3"]},{"id":"IN-MAL-2026-015809","import_time":"2026-08-05T16:13:48.071063255Z","modified_time":"2026-08-05T15:54:30Z","sha256":"1e30554b98d24d905f55de80fb216bba2367d2259bdd251636eab19c8b19019a","source":"amazon-inspector","versions":["1.0.0"]},{"id":"IN-MAL-2026-015810","import_time":"2026-08-05T16:13:48.234246535Z","modified_time":"2026-08-05T15:54:49Z","sha256":"aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325","source":"amazon-inspector","versions":["1.0.4"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}