Malicious code in stellarfix (npm)
The npm package 'stellarfix' contains a malicious Windows executable that runs automatically during installation on Windows systems. This executable acts as a remote-access trojan with capabilities including encrypted command-and-control communication, keystroke logging, window context capture, anti-termination measures, USB propagation, and data exfiltration. The package does not provide any legitimate functionality and solely serves to deliver and execute this malware on the host.
AI Analysis
Technical Summary
The 'stellarfix' npm package (versions 1.0.0, 1.0.3, and 1.0.4) includes a .NET Windows executable (bin/stellarfn.exe) launched automatically during npm install via a postinstall script. This executable implements a remote-access trojan with multiple malicious modules: a ClientSocket for AES-encrypted C2 communication, a keylogger using Windows hooks, focused window title capture, a bot and chat ID exfiltration pipeline, process anti-termination via SetCurrentProcessIsCritical, an uninstaller routine, USB removable media spreading capabilities, a plugin loader, and command handlers for URL opening, reporting, and monitoring. The package contains no legitimate code and its sole purpose is to infect the host system during installation.
Potential Impact
Installation of the 'stellarfix' package on Windows systems results in automatic execution of a remote-access trojan that can capture keystrokes, exfiltrate data, maintain persistence, spread via USB devices, and evade termination. This compromises the confidentiality, integrity, and availability of the affected system and potentially any connected networks or removable media.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing the 'stellarfix' package, especially on Windows systems. Remove any existing installations of the affected versions (=1.0.0, =1.0.3, =1.0.4) and scan affected systems for the presence of the malicious executable 'stellarfn.exe'. Monitor for suspicious postinstall activity in npm packages and consider using trusted package sources and integrity verification. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Malicious code in stellarfix (npm)
Description
The npm package 'stellarfix' contains a malicious Windows executable that runs automatically during installation on Windows systems. This executable acts as a remote-access trojan with capabilities including encrypted command-and-control communication, keystroke logging, window context capture, anti-termination measures, USB propagation, and data exfiltration. The package does not provide any legitimate functionality and solely serves to deliver and execute this malware on the host.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'stellarfix' npm package (versions 1.0.0, 1.0.3, and 1.0.4) includes a .NET Windows executable (bin/stellarfn.exe) launched automatically during npm install via a postinstall script. This executable implements a remote-access trojan with multiple malicious modules: a ClientSocket for AES-encrypted C2 communication, a keylogger using Windows hooks, focused window title capture, a bot and chat ID exfiltration pipeline, process anti-termination via SetCurrentProcessIsCritical, an uninstaller routine, USB removable media spreading capabilities, a plugin loader, and command handlers for URL opening, reporting, and monitoring. The package contains no legitimate code and its sole purpose is to infect the host system during installation.
Potential Impact
Installation of the 'stellarfix' package on Windows systems results in automatic execution of a remote-access trojan that can capture keystrokes, exfiltrate data, maintain persistence, spread via USB devices, and evade termination. This compromises the confidentiality, integrity, and availability of the affected system and potentially any connected networks or removable media.
Defensive Guidance
No official patch or remediation is currently documented. Users should avoid installing the 'stellarfix' package, especially on Windows systems. Remove any existing installations of the affected versions (=1.0.0, =1.0.3, =1.0.4) and scan affected systems for the presence of the malicious executable 'stellarfn.exe'. Monitor for suspicious postinstall activity in npm packages and consider using trusted package sources and integrity verification. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12216
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a73851ebf8831d5394ef780
Added to database: 08/05/2026, 18:46:54 UTC
Last enriched: 08/05/2026, 23:32:59 UTC
Last updated: 09/17/2026, 23:58:14 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.