🛡️ MAL-2026-12190 — retracfix

Malicious code in retracfix (npm)

Source: amazon-inspector

The npm package [email protected] ships with no documented functionality (empty description, no README, no source, no dependencies) and consists only of postinstall.js plus a single Windows PE at bin/ezfn.exe. package.json declares scripts.postinstall='node postinstall.js' and os=['win32']; postinstall.js enumerates bin/ for any.exe and unconditionally runs it via execFileSync on Windows installs. The bundled ezfn.exe is a.NET assembly whose metadata contains the type/member signatures of a remote-control agent and infostealer: ClientSocket / ConnectServer / BeginConnect / isConnected / ActivatePong for a C2 socket; SendBot / ChatID plus WebClient.DownloadString for a Telegram-bot exfil/command channel; ManagementObjectSearcher with the strings 'Antivirus' and 'Exclusion' for AV enumeration and Defender-exclusion registration; avicap32.dll for webcam capture; Microsoft.Win32 RegistryKey / CurrentUser Run-key persistence; WindowsIdentity/WindowsPrincipal privilege checks; SymmetricAlgorithm CreateEncryptor/Decryptor, WriteAllBytes, GetTempPath, InstallDir/InstallStr/LoggerPath; and a 'Spread' routine. The package name plus the binary name 'ezfn' (Easy Fortnite) fit a gaming-cheat lure. Running npm install retracfix on Windows drops and launches this binary, handing persistent remote control of the installer's host to the operator.