The img-to-native npm package, when required, reads a PNG image from its dependency cdn-img-fetch and extracts a hidden payload appended after the PNG IEND marker. This payload is base64-decoded and AES-256-CBC decrypted using a key derived from sha256('nif-runtime-2027'). The decrypted payload is then written as an executable file (%LOCALAPPDATA%\Programs\NodeRuntime\node_runtime_helper.exe) with execute permissions. The source image is deleted afterward. The package does not verify the payload's integrity or authenticity, allowing attacker-controlled code to be silently installed and executed. The dependency cdn-img-fetch is specified with a caret range (^1.0.0), permitting future versions to alter the payload. The advertised functionality does not require such behavior, indicating malicious intent. This results in full system compromise upon installation or loading of the package.

Installing or loading the img-to-native package results in attacker-controlled executable code being written and potentially executed on the victim's system. This leads to full system compromise, including potential unauthorized access to secrets and keys stored on the computer. The malicious payload is installed without verification, and the package's dependency versioning allows future payload changes without user consent.

No official patch or fix is indicated. The package should be removed immediately from any affected systems. Due to the high risk of full system compromise, all secrets and keys stored on the affected computer should be rotated from a different, trusted machine. Users should avoid installing or using this package and its dependency cdn-img-fetch. Monitor for any suspicious executables in the indicated path and consider full system remediation.