Executive Summary
In September 2025, a malicious npm package named 'fezbox' was discovered utilizing QR codes as a novel delivery mechanism for cookie-stealing malware. Masquerading as a legitimate utility library on npmjs.com, the package was downloaded at least 327 times before its removal. The attack involved the package embedding a reversed URL to evade detection, which, once decoded, retrieved a dense QR code image containing obfuscated, second-stage payload code. The malware specifically targeted credentials by harvesting cookies and sending harvested credentials to a command-and-control server via HTTPS POST, only proceeding if valid username and password data were detected.
This incident highlights the increasing creativity of supply-chain attackers, leveraging steganography within QR codes to bypass traditional static security tools. As QR codes become more commonplace and attackers innovate their use beyond social engineering, organizations must strengthen package vetting, threat detection, and response for open-source dependencies within their development ecosystems.
Why This Matters Now
The fezbox incident exposes a rapidly evolving supply-chain threat landscape where attackers use unconventional vectors like QR code steganography to evade detection. As open-source components remain foundational to software development, vigilance around third-party library integrity and advanced threat monitoring is a critical and urgent issue for organizations deploying modern application stacks.
Attack Path Analysis
The attacker achieved initial compromise through a malicious npm package masquerading as a utility library, exploiting the supply chain by inserting obfuscated code. No privilege escalation was required, as the package ran with the privileges of the executing user or process. The attack did not utilize network-based lateral movement but operated locally within the compromised environment. For command and control, it fetched a QR code image containing a second-stage payload, evading detection by hiding the C2 URL in a reversed string and steganographically encoding malicious instructions. Exfiltration occurred when stolen cookies and credentials were transmitted via HTTPS POST to a remote attacker-controlled server. Impact involved unauthorized exposure of user credentials and potential access to sensitive accounts and systems.
Kill Chain Progression
Initial Compromise
Description
The attacker published a malicious npm package ('fezbox') containing obfuscated code that, once installed, compromised downstream development or production environments.
Related CVEs
CVE-2025-XXXX
CVSS 9.3The 'fezbox' npm package contains malicious code that utilizes QR code steganography to extract and exfiltrate user credentials from browser cookies.
Affected Products:
N/A fezbox npm package – 1.3.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Command and Scripting Interpreter: JavaScript
Data Obfuscation
Obfuscated Files or Information
Deobfuscate/Decode Files or Information
Exfiltration Over C2 Channel
Credentials from Web Browsers
Application Layer Protocol: Web Protocols
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security of Software Applications
Control ID: 6.2.3
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 6
CISA ZTMM 2.0 – End-to-End Software Supply Chain Security
Control ID: Supply Chain Management.1
NIS2 Directive – Supply Chain Security
Control ID: Article 21(2)d
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Critical supply-chain vulnerability through malicious NPM packages using QR code steganography threatens software development pipelines and credential theft.
Information Technology/IT
High-risk exposure to cookie-stealing malware via compromised JavaScript packages, requiring enhanced egress security and threat detection capabilities.
Financial Services
Severe credential harvesting risks from supply-chain attacks targeting development environments, demanding zero trust segmentation and compliance controls.
Computer/Network Security
Novel QR code steganography attack vector bypasses traditional security tools, necessitating advanced anomaly detection and inline inspection solutions.
Sources
- NPM package caught using QR Code to fetch cookie-stealing malwarehttps://www.bleepingcomputer.com/news/security/npm-package-caught-using-qr-code-to-fetch-cookie-stealing-malware/Verified
- Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Techniquehttps://socket.dev/blog/malicious-fezbox-npm-package-steals-browser-passwords-from-cookies-via-innovative-qr-codeVerified
- Malicious Package in fezboxhttps://security.snyk.io/vuln/SNYK-JS-FEZBOX-13004510Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Zero Trust controls such as segmentation, east-west traffic monitoring, egress policy enforcement, inline inspection, and advanced threat detection can disrupt the attack lifecycle by isolating compromised workloads, preventing unauthorized data exfiltration, detecting anomalous behaviors, and limiting the attack's blast radius.
Control: Zero Trust Segmentation
Mitigation: Compromised workloads would be isolated, reducing exposure and attack surface.
Control: Kubernetes Security (AKF)
Mitigation: Limits the scope of credential access within microsegmented pods or namespaces.
Control: East-West Traffic Security
Mitigation: Blocks unauthorized internal connections to other services or workloads.
Control: Cloud Firewall (ACF) + Inline IPS (Suricata)
Mitigation: Threat signature detection and domain filtering block malicious command and control attempts.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents unauthorized outbound data transfers from workloads.
Rapid detection and response mitigate the impact of stolen credentials.
Impact at a Glance
Affected Business Functions
- Web Development
- Software Supply Chain
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of user credentials, including usernames and passwords, stored in browser cookies.
Recommended Actions
Key Takeaways & Next Steps
- • Adopt Zero Trust Segmentation to minimize attack surface and enforce least-privilege access for workloads and developers.
- • Implement strict egress security controls and FQDN filtering to prevent unauthorized data flow and C2 communications.
- • Deploy cloud-native inline IPS and firewalling (e.g., Suricata, ACF) for real-time threat signature inspection and malicious domain blocking.
- • Enhance Kubernetes and east-west security to curtail lateral movement and limit blast radius upon compromise.
- • Continuously monitor cloud workloads with threat detection and behavioral anomaly response to rapidly detect and contain supply chain attacks.
