Malicious code in stellarfix (npm)
The npm package stellarfix contains a malicious .NET Windows executable (stellarfn.exe) that is automatically executed during npm install via a postinstall script. The binary implements a full remote-access trojan with C2 communication, keystroke logging, window monitoring, anti-termination, USB propagation, and plugin loading capabilities.
- Disclosed
- Last updated
- Blast radius
- Windows npm install users
- Ecosystems
- Attack vectors
- Affected entities
- stellarfixnpm package containing malicious .NET Windows executable
The npm package stellarfix was found to contain a malicious .NET Windows executable bundled at bin/stellarfn.exe. A postinstall.js script enumerates and unconditionally executes the first .exe file in the bin directory via execFileSync during npm install, with the postinstall hook declared in package.json to run automatically on Windows systems.
The bundled binary exhibits characteristics of a full remote-access trojan, including a ClientSocket/ConnectServer C2 channel with AES-encrypted traffic, an XLogger keystroke-capture module using Windows API hooks (SetWindowsHookEx, LowLevelKeyboardProc, WM_KEYDOWN, ToUnicodeEx), window-focus monitoring (GetForegroundWindow, GetActiveWindowTitle), and a SendBot/ChatID exfiltration pipeline.
Additional malicious capabilities include ProcessCritical anti-termination (SetCurrentProcessIsCritical), an Uninstaller routine, a USBSpread module for propagation via removable media, a Plugin loader, and command handlers for OpenUrl, ReportWindow, and Monitoring operations.
The package contains no legitimate library code; its sole purpose is to deliver and execute this binary on the installer's host during installation.
Indicators of compromise
- Packages
- stellarfix
Remediation
- Immediately uninstall the stellarfix package from all systems
- Scan Windows systems that installed stellarfix for the stellarfn.exe binary and related malware artifacts
- Review npm install logs to identify affected hosts and installation timestamps
- Revoke or rotate any credentials or sensitive data that may have been exposed on affected systems
- Monitor affected systems for C2 communication and unauthorized access
- Block the package on internal npm registries and dependency management systems
- Audit npm package dependencies for similar malicious packages
Sources
- GitHub Advisory GHSA-w6wx-9jmh-f5p5 · GitHub Advisory Database
Cite this entry
"Malicious code in stellarfix (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-stellarfix-npm-yt8hjj
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in a.poltoradnev-package-a
The npm package a.poltoradnev-package-a contains malware that grants full system compromise to attackers. Any computer with this package installed should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - activecritical
Malware in @zynkit/probe
Malware discovered in the npm package @zynkit/probe. Systems with this package installed or running are considered fully compromised, with potential for complete system takeover.
npmCompromised package - activecritical
Malware in reseller-app
Malware discovered in the npm package reseller-app. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in awesome-ts-jest
Malware was discovered in the npm package awesome-ts-jest. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package