The Socket Threat Research Team has identified a sophisticated obfuscation scheme in a malicious npm package named fezbox (version 1.3.0), published by the npm alias “janedu” (registration email janedu0216@gmail[.]com).
Disguised as a high-performance JavaScript/TypeScript utility library featuring modules for standard helper functions and QR code manipulation, the package conceals a multi-tiered payload designed to extract credentials from browser cookies.
By embedding executable code within a steganographic QR code, the attacker evades traditional static and dynamic analysis, ultimately transmitting stolen “username” and “password” values to a remote server.
fezbox as known malware.fezbox’s public API exports familiar utilities, deep cloning, click handling, file upload, URL parsing, environment flags, and storage helpers alongside a QRCodeScriptLoader.
Hidden in its minified CommonJS bundle is a self-invoking function that activates only in production browser contexts and skips execution in development or when a 2-in-3 probabilistic check fails.
After a 120-second delay, it reconstructs a Cloudinary URL from a reversed string, fetches the QR code image, and invokes the loader’s parseQRCodeFromUrl method to retrieve embedded JavaScript, which it then executes.
Steganographic QR Code Retrieval
Once the QR code yields its payload, a compact, Unicode-escaped script defines a helper to read specific cookies by name, obfuscated via escaped property strings (for example, '\u0063\u006F\u006F\u006B\u0069\u0065') and bitwise no-ops.
It reverses the string “drowssap” to derive “password” at runtime. The script fetches cookie values for “username” and “password,” and if both are present, issues a POST request with a JSON body containing these credentials to https://my-nest-app-production.up.railway.app/users.
This attack chain layers classic evasion methods, string reversal, environment checks, and minification with an innovative steganographic vector.
By hiding executable code inside a QR code, threat actors exploit developers’ confidence in QR parsing utilities and complicate detection by conventional supply-chain scanners.
Most modern applications avoid storing plaintext credentials in cookies, limiting the attack’s potential impact. However, the creative use of QR-based steganography underscores the need for vigilant dependency inspection.
Developers should monitor for unexpected dynamic loaders, reversed strings, and post-install network calls.
Integrating specialized security tooling such as Socket’s GitHub App for real-time pull request scanning, CLI for install-time checks, browser extension for package browsing alerts, and MCP for AI-driven dependency suggestions into development pipelines can surface these stealthy behaviors.
As adversaries refine obfuscation techniques, embedding automated safeguards in CI/CD and local environments is critical to defending the software supply chain against advanced, multi-layered obfuscation attacks.
Indicators of Compromise
Malicious npm Package:
Fezbox
Threat Actor’s Alias and Registration Email
janedujanedu0216@gmail[.]com
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
.webp?fit=1068,580&ssl=1&description=npm Package QR Code Attack - The Socket team has identified a sophisticated obfuscation scheme in a malicious npm package named fezbox){kind=link}