Malicious code in ezfnfix (npm)
The npm package ezfnfix contains a malicious Windows PE binary (ezfn.exe) that executes automatically via a postinstall hook, functioning as a remote-access trojan and infostealer. The binary exfiltrates system and identity information via Telegram and socket C2 channels and establishes persistent remote access.
- Disclosed
- Last updated
- Blast radius
- Windows systems installing the affected npm package
- Ecosystems
- Attack vectors
- Affected entities
- ezfnfixnpm package containing malicious Windows PE binary
The npm package ezfnfix was found to contain malicious code in the form of a bundled Windows PE binary. When installed on Windows systems via npm install ezfnfix, the package automatically executes this binary through a postinstall hook defined in package.json that runs node postinstall.js.
The postinstall.js script enumerates executables in the bin/ directory and executes the first entry using execFileSync. The shipped bin/ezfn.exe is a ~114 KB VB.NET executable with no source code, build step, hash verification, or signature validation. Analysis of the binary's metadata reveals functionality consistent with a remote-access trojan and infostealer, including Telegram bot exfiltration primitives, socket-based C2 communication, spreading routines, antivirus/Windows Defender exclusion logic, webcam access capabilities, WMI-based host enumeration, registry persistence mechanisms, and network fetch functionality.
Installation on Windows results in immediate execution of the RAT against the installer's host, exfiltrating identity and system information via Telegram and socket channels while establishing persistent remote access. The binary's purpose bears no relation to the package name, indicating intentional malicious inclusion.
Indicators of compromise
- Packages
- ezfnfix
Remediation
- Immediately uninstall the ezfnfix package from all Windows systems
- Audit npm install logs to identify systems that may have installed this package
- Scan affected Windows systems for the presence of bin/ezfn.exe and related artifacts
- Check for unauthorized Telegram bot communications and socket C2 connections from affected hosts
- Review Windows registry for persistence mechanisms installed by the malicious binary
- Reset credentials and review account activity on systems that installed this package
- Monitor for signs of remote access or data exfiltration from affected systems
- Use npm audit to identify and remove the malicious package from dependency trees
Sources
- GitHub Advisory GHSA-c47g-cvrf-jpw3 · GitHub Advisory Database
Cite this entry
"Malicious code in ezfnfix (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-ezfnfix-npm-rate83
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - containedcritical
Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
npmCompromised package - resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - containedcritical
Malicious code in npm-wold (npm)
npm-wold@1.1.1 contains malicious code in its postinstall script that fetches remote JSON from a hardcoded endpoint and dynamically invokes attacker-controlled functions with attacker-supplied arguments, enabling code execution at install time.
npmCompromised package