MAL-2026-13353 Malicious code in stellarfixer (npm)
Malicious package
Published
MAL-2026-13353 is a malicious package: stellarfixer (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-13353/ (Markdown: https://insights.sbomify.com/MAL-2026-13353/index.md)
- Package
- stellarfixer
- Registry
- npm
What is MAL-2026-13353?
MAL-2026-13353 is a malicious package in stellarfixer, published on 5 Aug 2026.
Official description
On npm install, the package's postinstall script unconditionally executes a bundled Windows PE at bin/stellarfn.exe via execFileSync. The binary is a.NET remote-access trojan: it opens a socket-based C2 channel (ClientSocket/BeginConnect/ConnectServer, SendMSG, SendBot/ChatID) with plugin loading (WriteAllBytes/ReadAllBytes), installs a low-level keyboard hook (SetWindowsHookEx + WH_KEYBOARD_LL + LowLevelKeyboardProc + ToUnicodeEx) tagged with active-window titles (GetForegroundWindow/GetActiveWindowTitle) for system-wide credential-grade keystroke capture, captures webcam frames (capCreateCaptureWindowA/capGetDriverDescriptionA), propagates to removable drives (USBThread/USBStart/USBSpread/RunDisk), and includes AV-exclusion, SetCurrentProcessIsCritical anti-kill, AES payload encryption, and an uninstaller. Installing this package on a Windows host results in immediate full-host compromise, remote attacker control, credential theft, and worm-like USB propagation.
What should I do about MAL-2026-13353?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.