MAL-2026-12216 Malicious code in stellarfix (npm)

stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/*.exe and unconditionally launches the first one via execFileSync during npm install. The package.json declares scripts.postinstall=node postinstall.js, so the binary runs automatically on any Windows installer. The bundled binary contains class and P/Invoke symbols consistent with a full remote-access trojan: a ClientSocket/ConnectServer C2 channel with AES-encrypted traffic, an XLogger module using SetWindowsHookEx / LowLevelKeyboardProc / WM_KEYDOWN / ToUnicodeEx to capture keystrokes and GetForegroundWindow / GetActiveWindowTitle to capture focused-window context, a SendBot/ChatID exfiltration pipeline, ProcessCritical (SetCurrentProcessIsCritical) anti-termination, an Uninstaller routine, a USBSpread module (USBThread/USBStart/USBCode) for removable-media propagation, a Plugin loader, and OpenUrl/ReportWindow/Monitoring command handlers. The package contains no legitimate library code; its sole install-time effect is delivering and running this binary on the installer's host.