Malicious npm packages now hide malware in image payloads

At a glance

What this is: This is a supply-chain analysis of a malicious npm package that used postinstall execution, Windows persistence, UAC bypass, and steganographic PNG payloads to deliver a RAT.

Why it matters: It matters to IAM and security teams because package trust, script execution, and admin escalation create identity-adjacent attack paths that bypass conventional perimeter controls.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read Veracode's analysis of the malicious npm package hidden in PNG images

Context

Malicious package abuse is no longer limited to obvious script payloads. In this case, the attacker used an npm postinstall hook, a downloaded batch file, registry-based UAC bypass, and image steganography to move from package installation to remote code execution. That makes the primary issue not just malware delivery, but the trust assumptions embedded in software supply chains and developer endpoints.

The identity angle is real because the attack relied on privileged execution paths, startup persistence, and hidden credential-like control channels rather than a single exploit. For teams governing NHI, secrets, and build systems, the lesson is that package trust and runtime privilege are part of the same control surface. This is a supply-chain pattern, not an isolated malware trick.

Key questions

Q: What breaks when package installation is allowed to run arbitrary scripts?

A: The installation step becomes an execution boundary instead of a supply-chain check. Malicious packages can trigger code before developers notice the package is suspicious, which lets attackers stage persistence, download second-stage payloads, or begin privilege escalation inside trusted environments. Controlling lifecycle scripts is one of the clearest ways to reduce that risk.

Q: Why do hidden payloads in image files matter to security teams?

A: Image files are often treated as low-risk content, so they can bypass controls that focus on executables, archives, or obvious scripts. When attackers hide payloads in PNGs or similar formats, defenders need provenance checks, behavioural detection, and content inspection that looks beyond file extension and visual appearance.

Q: How do developers and security teams detect stealthy privilege escalation in malware chains?

A: Look for protocol-handler registry changes, suspicious startup-folder writes, parent-child process anomalies, and elevated execution without normal user intent. Those signals often appear before the final payload is launched. If endpoint telemetry is already tuned for those patterns, the attack has far less room to turn installation access into durable compromise.

Q: Which controls matter most when malware is designed to evade AV and AMSI?

A: Execution control, memory-protection telemetry, and script visibility matter more than a single scanner. If malware can patch AMSI, use hardware breakpoints, or branch around specific AV products, the response has to combine application control, endpoint behaviour analytics, and stricter trust rules for package sources and downloaded code.

Technical breakdown

How postinstall hooks become an initial execution path

npm postinstall hooks execute automatically when a package is installed, which turns package installation into code execution. In this case, the package looked simple but triggered init.js immediately, then used a downloaded batch file to continue the chain. Attackers favour this because developers often grant installation trust faster than they would approve a standalone binary. The install process becomes the delivery mechanism, and the package metadata becomes the trigger. Once code runs in the developer context, the attacker can stage persistence, download additional payloads, or prepare privilege escalation.

Practical implication: restrict or review lifecycle scripts in package workflows before they reach developer machines or CI runners.

Why steganographic PNG payloads complicate detection

Steganography hides data inside image pixels rather than in an obvious executable or script body. Here, the malware encoded payload length in the first pixels, then stored bytes across RGB channels so the image looked like random noise. That defeats many content scanners because the file is syntactically valid PNG and visually harmless. The real payload only appears after a decoding routine reconstructs the bytes, then decrypts and decompresses them. This is a classic example of payload smuggling through innocuous file types.

Practical implication: inspect image downloads and other benign file types for unusual entropy, hidden payload structures, and external fetch behaviour.

How registry hijacking and process hollowing turn execution into persistence

The batch file used the fodhelper.exe UAC bypass by hijacking a registry handler, then copied itself into the startup folder for persistence. The later .NET loader used process hollowing, which starts a legitimate process in a suspended state and replaces its memory with attacker code. That combination gives the malware elevated execution, stealth, and a normal-looking process lineage. It also includes AV-aware branching and AMSI bypass logic, which means the malware adapts its path based on local defensive tools. This is not just persistence. It is staged runtime control.

Practical implication: monitor registry changes, startup folder writes, and suspicious parent-child process chains that indicate hollowing or elevation abuse.

Threat narrative

Attacker objective: The attacker aimed to gain stealthy remote access to compromised Windows endpoints while evading endpoint scanning and maintaining persistence.

1. Entry occurred through a typosquatted npm package that executed a postinstall hook during installation and launched a downloaded batch file.
2. Credential or privilege access was gained through a registry-based fodhelper.exe UAC bypass that elevated the script without a visible prompt.
3. Impact followed when the loader used steganographic PNG payloads, AMSI bypasses, and process hollowing to deploy a Pulsar RAT with persistent remote control.

NHI Mgmt Group analysis

Supply-chain trust is now an identity problem as much as a code integrity problem. The attack worked because package installation was treated as low-risk, yet it executed code in a trusted developer context and then escalated into privileged runtime behaviour. That places software packages, install hooks, and startup persistence inside the same governance conversation as secrets and service accounts. Practitioners should treat package trust as a controlled identity boundary, not a convenience layer.

Hidden payloads inside benign file types create a detection gap that static scanning will not close on its own. PNG steganography matters because the file format is legitimate, the bytes are concealed, and the malicious logic is deferred until runtime extraction. Security teams need to think in terms of behavior, file provenance, and external fetch patterns rather than signatures alone. The operational conclusion is that content inspection must be paired with execution controls.

Privilege escalation remains the decisive step that turns commodity malware into durable access. The registry-based UAC bypass and process hollowing chain show how attackers combine elevation, stealth, and persistence to survive basic endpoint controls. This is the same governance pattern seen when standing privilege is left available to code that does not need it. Teams should map these techniques to control gaps around least privilege, script execution, and endpoint hardening.

AMSI bypass logic reveals a broader problem: attackers now design for defensive adaptation at build time. AV-aware branching and multiple bypass methods mean the malware is not waiting to discover defenses after deployment. It is coded to route around them. That should push practitioners toward layered controls across package intake, execution policy, memory protection, and endpoint telemetry rather than relying on a single scanning layer.

Steganographic malware is a marker of maturation in the supply-chain threat economy. The more effort attackers put into concealment, the more they expect defenders to look only at obvious binaries and scripts. That changes the control baseline for build pipelines, developer workstations, and software provenance reviews. Practitioners should assume that package trust, file type trust, and process trust can all be separately abused.

What this signals

Hidden payload delivery is a governance problem, not just a malware-analysis problem. When attackers use package scripts, image files, and privilege escalation in one chain, the failure sits across software intake, endpoint control, and runtime trust. That means build pipelines and developer workstations need policy boundaries that assume untrusted content can arrive through apparently safe formats.

The broader signal is that attackers are engineering for inspection gaps, not just for execution. They are using file types, installation hooks, and AV-specific branching to delay detection until after persistence is established. For practitioners, the control question becomes whether telemetry can catch the transition from package trust to privileged execution quickly enough to matter.

Package trust and secret trust are converging. The same operational weakness that lets a malicious package run can also expose API keys, tokens, or CI credentials if developer environments are over-permissive. That is why identity governance, secrets hygiene, and software provenance need to be evaluated together, not as separate programmes.

For practitioners

• Block lifecycle script execution by default Disable automatic execution of npm lifecycle hooks such as postinstall in environments where packages are not fully trusted, and require explicit approval for packages that need install-time scripts. This narrows the initial execution path and makes typosquatted package abuse harder to weaponise.
• Inspect benign file types for hidden payload behaviour Add detections for anomalous image downloads, high-entropy PNGs, and external fetches that precede PowerShell or memory-loading activity. Steganography is effective because the file looks harmless until a decoder reconstructs the payload.
• Harden privilege boundaries on developer endpoints Monitor registry edits tied to protocol handlers, startup-folder persistence, and UAC bypass patterns such as fodhelper.exe abuse. Pair that with least-privilege accounts so a compromised installer cannot immediately reach admin execution.
• Treat AMSI bypass indicators as a priority signal Look for attempts to resolve amsi.dll, patch AmsiScanBuffer, or use hardware breakpoints and vectored exception handlers around scanning functions. These patterns indicate the malware is actively trying to neutralise inspection before its payload runs.

Key takeaways

• Malicious npm packages can move from install-time execution to privileged persistence without ever shipping an obvious binary.
• Steganographic PNG payloads and AV-aware branching show that attackers now design for inspection failure, not just payload delivery.
• Teams should treat package lifecycle controls, endpoint privilege boundaries, and AMSI-aware detection as one governance problem.

Key terms

• Postinstall Hook: A postinstall hook is a package script that runs automatically after installation. In supply-chain attacks, it becomes an execution trigger because code runs inside the installer’s trust boundary before the package has been meaningfully evaluated for malicious behaviour.
• Steganography: Steganography is the practice of hiding data inside another file so the outer file still looks normal. In malware operations, images, audio, or documents can carry concealed payload bytes that are only revealed when a custom extraction routine reads the file in a specific way.
• Process hollowing: Process hollowing is a method where malicious code is placed into a legitimate process after that process is started in a suspended state. The original binary remains present, but its memory is replaced with attacker code, which helps hide the malware from basic file-centric defenses and simple reputation checks.
• AMSI Bypass: An AMSI bypass is any method used to prevent Anti-malware Scan Interface inspection from seeing script or in-memory content. Attackers may patch memory, alter return values, or interrupt scanning logic so later payload stages execute without the usual endpoint scrutiny.

What's in the full report

Veracode's full analysis covers the operational detail this post intentionally leaves for the source:

• Step-by-step deobfuscation of the batch script and the exact payload fragments hidden across 909 variables
• Full pixel-extraction logic for the steganographic PNGs and the payload sizes recovered from each image
• Loader internals for the .NET process hollowing chain, including AMSI bypass methods and persistence paths
• Indicators of compromise and package names that security teams can use for hunting and triage

👉 The full Veracode post covers the attack chain, payload extraction details, and indicators of compromise

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in practical terms. It helps practitioners connect identity controls to the wider security programme they already run.