Notifications
Clear all
Topic starter
02/08/2026 11:59 am
TL;DR: A malicious npm package used install-time execution, registry-based privilege escalation, steganographic PNG payloads, and AV-aware branching to deliver a Pulsar RAT, according to Veracode Threat Research. Hidden payload delivery is now a supply-chain and identity governance problem, because developer trust in packages and script execution still outpaces control coverage.
NHIMG editorial — based on content published by Veracode: Hiding in Plain Pixels, malicious npm package found by Veracode Threat Research
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when package installation is allowed to run arbitrary scripts?
A: The installation step becomes an execution boundary instead of a supply-chain check.
Q: Why do hidden payloads in image files matter to security teams?
A: Image files are often treated as low-risk content, so they can bypass controls that focus on executables, archives, or obvious scripts.
Q: How do developers and security teams detect stealthy privilege escalation in malware chains?
A: Look for protocol-handler registry changes, suspicious startup-folder writes, parent-child process anomalies, and elevated execution without normal user intent.
Practitioner guidance
- Block lifecycle script execution by default Disable automatic execution of npm lifecycle hooks such as postinstall in environments where packages are not fully trusted, and require explicit approval for packages that need install-time scripts.
- Inspect benign file types for hidden payload behaviour Add detections for anomalous image downloads, high-entropy PNGs, and external fetches that precede PowerShell or memory-loading activity.
- Harden privilege boundaries on developer endpoints Monitor registry edits tied to protocol handlers, startup-folder persistence, and UAC bypass patterns such as fodhelper.exe abuse.
What's in the full report
Veracode's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step deobfuscation of the batch script and the exact payload fragments hidden across 909 variables
- Full pixel-extraction logic for the steganographic PNGs and the payload sizes recovered from each image
- Loader internals for the .NET process hollowing chain, including AMSI bypass methods and persistence paths
- Indicators of compromise and package names that security teams can use for hunting and triage
👉 Read Veracode's analysis of the malicious npm package hidden in PNG images →
Malicious npm packages and image steganography: what teams need to know?
Explore further
02/08/2026 1:06 pm
Supply-chain trust is now an identity problem as much as a code integrity problem. The attack worked because package installation was treated as low-risk, yet it executed code in a trusted developer context and then escalated into privileged runtime behaviour. That places software packages, install hooks, and startup persistence inside the same governance conversation as secrets and service accounts. Practitioners should treat package trust as a controlled identity boundary, not a convenience layer.
A question worth separating out:
Q: Which controls matter most when malware is designed to evade AV and AMSI?
A: Execution control, memory-protection telemetry, and script visibility matter more than a single scanner. If malware can patch AMSI, use hardware breakpoints, or branch around specific AV products, the response has to combine application control, endpoint behaviour analytics, and stricter trust rules for package sources and downloaded code.
👉 Read our full editorial: Malicious npm packages now hide malware in image payloads
