New npm Malware Steals Browser Passwords via Steganographic QR Code

A novel npm package named fezbox has been uncovered by the Socket Threat Research Team as a sophisticated malware delivery mechanism that exfiltrates username and password credentials from browser cookies via an embedded QR code. Published under the npm alias janedu (registration email janedu0216@gmail[.]com), the package masquerades as a harmless JavaScript/TypeScript utility library while quietly fetching and executing obfuscated code within a steganographic QR code image hosted on Cloudinary.

The threat uses three obfuscation techniques—reversed strings, a steganographic QR code, and a minified payload—to conceal the credential-stealing behaviour, with the malicious code dormant for about two minutes before it loads a QRCodeScriptLoader and retrieves the hidden payload. It then reads cookies for username and password and sends them via HTTPS POST to the actor’s server, after which it exits quietly.

According to Socket Threat Research Team, fezbox remains live on npm at the time of writing, and npm’s security team has been petitioned to remove the package and suspend the threat actor’s account.