MAL-2026-12190
Dashboard / Malicious Package / MAL-2026-12190
MAL-2026-12190
Summary: Malicious code in retracfix (npm)
Details: Source: amazon-inspector (7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4) The npm package [email protected] ships with no documented functionality (empty description, no README, no source, no dependencies) and consists only of postinstall.js plus a single Windows PE at bin/ezfn.exe. package.json declares scripts.postinstall='node postinstall.js' and os=['win32']; postinstall.js enumerates bin/ for any.exe and unconditionally runs it via execFileSync on Windows installs. The bundled ezfn.exe is a.NET assembly whose metadata contains the type/member signatures of a remote-control agent and infostealer: ClientSocket / ConnectServer / BeginConnect / isConnected / ActivatePong for a C2 socket; SendBot / ChatID plus WebClient.DownloadString for a Telegram-bot exfil/command channel; ManagementObjectSearcher with the strings 'Antivirus' and 'Exclusion' for AV enumeration and Defender-exclusion registration; avicap32.dll for webcam capture; Microsoft.Win32 RegistryKey / CurrentUser Run-key persistence; WindowsIdentity/WindowsPrincipal privilege checks; SymmetricAlgorithm CreateEncryptor/Decryptor, WriteAllBytes, GetTempPath, InstallDir/InstallStr/LoggerPath; and a 'Spread' routine. The package name plus the binary name 'ezfn' (Easy Fortnite) fit a gaming-cheat lure. Running `npm install retracfix` on Windows drops and launches this binary, handing persistent remote control of the installer's host to the operator.
References: https://www.npmjs.com/package/retracfix/v/1.0.1, https://www.npmjs.com/package/retracfix/v/1.0.0, https://www.npmjs.com/package/retracfix/v/1.0.3
Affected packages
Package
Name: retracfix
Purl: pkg:npm/retracfix
Affected ranges
Type: N/A
Events:
