A malicious package uses a QR code as steganography in an innovative technique.

stapp · Sep 23, 2025 at 2:11 AM

Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
Click to expand...

Threat actors use many different techniques to obfuscate malicious code, like reversing strings, encoding, and encryption. The Socket Threat Research Team discovered a malicious package, fezbox, with layers of obfuscation including the innovative, steganographic use of a QR code. In this package, the threat actor (npm alias janedu; registration email janedu0216@gmail[.]com) executes a payload within a QR code to steal username and password credentials from web cookies, within the browser.

At the time of writing, the malicious package remains live on npm. We have petitioned the npm security team for its removal and for the suspension of the threat actor’s account.
Click to expand...

https://socket.dev/blog/malicious-f...passwords-from-cookies-via-innovative-qr-code

Log in or Sign up

A malicious package uses a QR code as steganography in an innovative technique.

stapp Global Moderator

Log in or Sign up

A malicious package uses a QR code as steganography in an innovative technique.

stapp Global Moderator

Useful Searches