MAL-2026-12216

    Dashboard / Malicious Package / MAL-2026-12216

    MAL-2026-12216

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in stellarfix (npm)

    Details: Source: amazon-inspector (aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325) stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and unconditionally launches the first one via execFileSync during npm install. The package.json declares scripts.postinstall=node postinstall.js, so the binary runs automatically on any Windows installer. The bundled binary contains class and P/Invoke symbols consistent with a full remote-access trojan: a ClientSocket/ConnectServer C2 channel with AES-encrypted traffic, an XLogger module using SetWindowsHookEx / LowLevelKeyboardProc / WM_KEYDOWN / ToUnicodeEx to capture keystrokes and GetForegroundWindow / GetActiveWindowTitle to capture focused-window context, a SendBot/ChatID exfiltration pipeline, ProcessCritical (SetCurrentProcessIsCritical) anti-termination, an Uninstaller routine, a USBSpread module (USBThread/USBStart/USBCode) for removable-media propagation, a Plugin loader, and OpenUrl/ReportWindow/Monitoring command handlers. The package contains no legitimate library code; its sole install-time effect is delivering and running this binary on the installer's host.

    References: https://www.npmjs.com/package/stellarfix/v/1.0.3, https://www.npmjs.com/package/stellarfix/v/1.0.0, https://www.npmjs.com/package/stellarfix/v/1.0.4

    Affected packages

    Package

    Name: stellarfix

    Purl: pkg:npm/stellarfix

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.3
    1.0.0
    1.0.4