The ezfnfix npm package (version 1.0.0) includes a postinstall hook that automatically runs a VB.NET executable (bin/ezfn.exe) on Windows. This executable contains multiple malicious functionalities consistent with a remote-access trojan and infostealer, including Telegram bot communication for data exfiltration, socket-based command and control, spreading routines, antivirus exclusion techniques, webcam access, system information gathering via WMI, registry persistence, symmetric cryptography, and network fetching capabilities. The binary is shipped without source code or verification mechanisms, and installing the package results in immediate execution of the RAT on the host system.

Installing ezfnfix version 1.0.0 on a Windows system results in immediate execution of a remote-access trojan that exfiltrates sensitive identity and system information. The malware establishes persistent access, evades antivirus detection, can access the webcam, and communicates with remote command and control servers. This compromises the confidentiality, integrity, and availability of the affected system.

Do not install ezfnfix version 1.0.0 on Windows systems. Since no patch or remediation is currently available, remove the package if installed and perform a thorough malware cleanup and system investigation. Monitor for suspicious network activity related to Telegram or unknown socket connections. Check vendor advisories or npm security advisories for updates or removal notices.