Malicious code in ezfnfix (npm)
The npm package ezfnfix contains a malicious Windows PE binary (ezfn.exe) that executes automatically via a postinstall hook, functioning as a remote-access trojan and infostealer. The binary exfiltrates system and identity information via Telegram and socket C2 channels and establishes persistent remote access.
- Disclosed
- Last updated
- Blast radius
- Windows systems installing the affected npm package
- Ecosystems
- Attack vectors
- Affected entities
- ezfnfixnpm package containing malicious Windows PE binary
The npm package ezfnfix was found to contain malicious code in the form of a bundled Windows PE binary. When installed on Windows systems via npm install ezfnfix, the package automatically executes this binary through a postinstall hook defined in package.json that runs node postinstall.js.
The postinstall.js script enumerates executables in the bin/ directory and executes the first entry using execFileSync. The shipped bin/ezfn.exe is a ~114 KB VB.NET executable with no source code, build step, hash verification, or signature validation. Analysis of the binary's metadata reveals functionality consistent with a remote-access trojan and infostealer, including Telegram bot exfiltration primitives, socket-based C2 communication, spreading routines, antivirus/Windows Defender exclusion logic, webcam access capabilities, WMI-based host enumeration, registry persistence mechanisms, and network fetch functionality.
Installation on Windows results in immediate execution of the RAT against the installer's host, exfiltrating identity and system information via Telegram and socket channels while establishing persistent remote access. The binary's purpose bears no relation to the package name, indicating intentional malicious inclusion.
Indicators of compromise
- Packages
- ezfnfix
Remediation
- Immediately uninstall the ezfnfix package from all Windows systems
- Audit npm install logs to identify systems that may have installed this package
- Scan affected Windows systems for the presence of bin/ezfn.exe and related artifacts
- Check for unauthorized Telegram bot communications and socket C2 connections from affected hosts
- Review Windows registry for persistence mechanisms installed by the malicious binary
- Reset credentials and review account activity on systems that installed this package
- Monitor for signs of remote access or data exfiltration from affected systems
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-c47g-cvrf-jpw3 · GitHub Advisory Database
Cite this entry
"Malicious code in ezfnfix (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-ezfnfix-npm-rate83
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in fetch-runtime
Malware was discovered in the npm package fetch-runtime. Any system with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - resolvedcritical
Malicious code in ghazaly (npm)
The npm package ghazaly version 99.9.0 contained malicious code that executed a postinstall hook to collect system information (hostname, current user, IP addresses) and exfiltrate it to a Burp Collaborator domain. The package exhibited dependency-confusion characteristics with a high version number and nonsense dependencies.
npmCompromised packageDependency confusion - containedcritical
Malicious code in base65-13x (npm)
base65-13x@5.0.2 on npm contains malicious obfuscated code disguised as a legitimate base-x library. The decode() function executes a ~123KB VM-style payload with dynamic code construction and network I/O capabilities.
npmCompromised package - containedcritical
Malicious code in kit-vim-map (npm)
The npm package kit-vim-map contained malicious code that executes a remote-controlled Linux ELF binary on installation, providing the attacker with arbitrary RCE, persistence, and file exfiltration capabilities. The binary beacons to C2 server 217.60.77.63 and establishes persistence via systemd user units.
npmCompromised packageMalicious commit