MalwarePublished 5 Aug 2026

stellarfixer (npm) · Malicious Code

Affects stellarfixerSource GCVE Database

Malicious package : remove stellarfixer and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 23:17 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13353

What to do

Remove stellarfixer from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstellarfixer	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'stellarfixer' version 1.0.0 contains malicious code that executes a bundled Windows PE file during installation. This binary is a .NET remote-access trojan that establishes a command-and-control channel, captures keystrokes including credentials, records webcam frames, propagates via USB drives, and employs anti-detection and anti-termination techniques. Installing this package on a Windows system leads to full host compromise and remote attacker control.

Impact

Installing the 'stellarfixer' package version 1.0.0 on a Windows host results in immediate full system compromise. The attacker gains remote control via a command-and-control channel, can steal credentials through keystroke logging, capture webcam video, and propagate the malware to removable drives, enabling further spread. The malware also employs anti-detection and anti-termination techniques, increasing persistence and evasion capabilities.

Defensive guidance

Since this is a malicious package, the primary mitigation is to avoid installing 'stellarfixer' version 1.0.0 or any untrusted npm packages. Remove the package and any associated files if already installed on Windows systems. Employ endpoint security solutions to detect and remove the trojan binary. Monitor for suspicious postinstall scripts in npm packages before installation.

Summary

The 'stellarfixer' npm package (version 1.0.0) includes a postinstall script that unconditionally runs a bundled Windows executable (bin/stellarfn.exe). This executable is a .NET-based remote-access trojan (RAT) that opens a socket-based command-and-control channel. It supports plugin loading, installs a low-level keyboard hook for system-wide credential-grade keystroke logging tagged with active window titles, captures webcam frames, and propagates itself to removable USB drives. The malware includes features to evade antivirus detection, prevent process termination via SetCurrentProcessIsCritical, encrypts its payload with AES, and has an uninstaller. The infection results in immediate full host compromise, credential theft, and worm-like propagation on Windows hosts.

References

npmjs.com/package/stellarfixer/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 23:17 UTC

Technical details

References

Community reviews