The 'stellarfixer' npm package (version 1.0.0) includes a postinstall script that unconditionally runs a bundled Windows executable (bin/stellarfn.exe). This executable is a .NET-based remote-access trojan (RAT) that opens a socket-based command-and-control channel. It supports plugin loading, installs a low-level keyboard hook for system-wide credential-grade keystroke logging tagged with active window titles, captures webcam frames, and propagates itself to removable USB drives. The malware includes features to evade antivirus detection, prevent process termination via SetCurrentProcessIsCritical, encrypts its payload with AES, and has an uninstaller. The infection results in immediate full host compromise, credential theft, and worm-like propagation on Windows hosts.

Installing the 'stellarfixer' package version 1.0.0 on a Windows host results in immediate full system compromise. The attacker gains remote control via a command-and-control channel, can steal credentials through keystroke logging, capture webcam video, and propagate the malware to removable drives, enabling further spread. The malware also employs anti-detection and anti-termination techniques, increasing persistence and evasion capabilities.

No official patch or remediation is currently documented. Since this is a malicious package, the primary mitigation is to avoid installing 'stellarfixer' version 1.0.0 or any untrusted npm packages. Remove the package and any associated files if already installed on Windows systems. Employ endpoint security solutions to detect and remove the trojan binary. Monitor for suspicious postinstall scripts in npm packages before installation. Patch status is not yet confirmed — check vendor or npm advisories for updates.