New Malware Found in npm Package “fezbox” Uses QR Codes to Steal Credentials

The Socket Threat Research Team has uncovered a new malware campaign hidden inside an npm package called fezbox, which pretends to be a JavaScript/TypeScript utility library. According to Socket, fezbox uses multiple layers of obfuscation, including a QR code as a payload delivery mechanism, and importing the library triggers a hidden routine.

The researchers say the package waits 120 seconds, then downloads and parses a QR code from a Cloudinary image URL, whose JavaScript payload steals credentials from web cookies. When executed, the payload reads document.cookie to extract a username and password, obfuscated by string reversal, and transmits them via an HTTPS POST to a URL resembling https://my-nest-app-production.up.railway[.]app/users. Fezbox also employs at least three layers of obfuscation, including reversed strings and QR code steganography.

Developers are urged to remove fezbox from projects, audit dependencies, and rotate any credentials that may have been exposed, with npm being petitioned to remove the package. According to the article, the piece was published on 23 September 2025.