fezbox was a malicious npm package that concealed a credential-stealing payload inside a QR code embedded in a JPG. In September 2025, researchers found that the JavaScript/TypeScript utility fetched the image, decoded delayed and obfuscated instructions, and attempted to send browser cookies and form credentials. The package was removed and flagged as malware, but anyone who installed it should treat the affected environment as compromised.
What was the fezbox npm incident?
fezbox was presented as a utility library for JavaScript and TypeScript. Socket Threat Research identified it in September 2025, and Dark Reading reported that the package concealed credential-stealing malware in steganographic QR codes. BleepingComputer described the package as fetching a JPG that contained a QR code and using the decoded content to deliver a second-stage payload.
The npm registry showed at least 327 downloads before administrators removed the package. That is an incident-time registry count from 2025, not a confirmed number of infected users or a final victim total.
How the QR-code payload worked
The attack used several layers so that a quick source review or a scanner looking only for obvious web addresses could miss the malicious logic.
#1 Best Overall
- Continuous Usage All Day: The EY-H2 USB barcode scanner is designed to always be ready for the next scan, which significantly reduces downtime and repair costs; it shortens checkout lines, improves customer service, and boosts business productivity
- Plug and Play: Eyoyo wired barcode scanner is connected via a USB cable, with no need to install any driver or software; It offers effortless connection and is compatible with Windows, Mac, Android, and Linux; Seamlessly works with Quickbook, Word, Excel, Novell, and all common software
- Supports Multiple 1D/2D Barcodes: Eyoyo QR code scanner scan with most 1D 2D barcodes with ease; 1D Barcodes: EAN, UPC, Code 39, Code 93, Code 128, UCC/EAN 128, Codabar, Interleaved 2 of 5, ITF-6, ITF-14, ISBN, ISSN, MSI-Plessey, GS1 Databar, Code 11, Industrial 25, Matrix 2 of 5, etc. 2D Barcodes: QR, DataMatrix, PDF417, and so on
- Supports Screen Scanning: The Eyoyo 2D scanner is capable of reading barcodes from smartphone screens, such as mobile coupons, digital wallets, and digital loyalty cards; Before scanning, simply turn your screen brightness to the maximum
- Sturdy Anti-Shock and Durable Design: The Eyoyo 2D barcode scanner features an ergonomic design made of high-quality ABS, enabling it to withstand repeated drops from 5 ft/1.5 m high onto the concrete ground; The durable plastic material ensures a long service life
- Reversed remote URL: The package stored the address of a remote JPG backwards and reconstructed it at runtime. Reversing the string helped avoid simple searches for ordinary
http://orhttps://patterns. - Delayed, environment-aware execution: The code checked whether it appeared to be running in a development or analysis environment. BleepingComputer reported a delay of about 120 seconds before QR parsing and execution, reducing the chance that automated inspection would observe the full behavior.
- Image retrieval: After the delay, the package fetched a JPG from the remote server. Image traffic can look routine to tools that do not inspect the contents of downloaded media.
- Dense QR code: The JPG contained an unusually dense QR code. It was not intended for a person to scan with a phone; the package decoded it as a carrier for obfuscated instructions.
- Obfuscated second stage: The decoded instructions led to another layer of obfuscated code. Researchers found reversed strings, the QR image, and the payload itself all contributing to the concealment.
- Credential collection: The payload read
document.cookie, searched the page for username and password fields, and issued an HTTPS POST when both values were present. If it could not find both values, it exited quietly.
Socket Threat Research analyst Olivia Brown described the technique this way: “Steganography is the practice of hiding a secret file in plain sight, something for which QR codes are great.”
Why a QR code is an effective malware carrier
A QR code is normally treated as data, not as executable source. That assumption creates a blind spot when a package includes a decoder and then interprets the decoded text as instructions. Cofense Phishing Defense Center senior director Chance Caldwell called it “a far more advanced technique: embedding obfuscated malicious code directly within the QR code itself.”
Rank #2
- 【Battery Level Indicator and 2200mAh Capacity】Larger battery enables longer continuous usage and twice the stand-by time of others. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
- 【Ergonomic Design】 The curved handle is extended and thickened, tailor-made for North America customers. Specially designed smooth and flat trigger for better grip. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1.
- 【Anti-Shock Silicone】 The orange anti-shock silicone protective cover can avoid scratches and friction while falling from the height of 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
- 【2.4 GHz Wireless plus USB 2.0 Wired Connection】 Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
- 【Digital and Printed 1D 2D QR Bar Code Symbologies】1D: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard25, Matrix 2D: QR, DataMatrix, Aztec, Hanxin, Micro PDF417. (Note: Not compatible with Square.)
| Review question | What a conventional review may see | What the fezbox chain added |
|---|---|---|
| Visibility | Readable utility code, package metadata and a plausible README | Reversed strings, an image, a QR code and an obfuscated payload |
| Execution timing | Behavior during installation or import | A roughly 120-second delay and checks intended to avoid analysis environments |
| Delivery channel | JavaScript fetched from a recognizable URL | A remote JPG whose QR data carried the next-stage instructions |
| Defensive coverage | Static pattern matching and README review | Dependency provenance, behavioral analysis, QR and image inspection, and runtime monitoring |
Dark Reading reported that the README mentioned a QR Code Module and automatically loaded dependencies, but did not disclose that importing the library could fetch a remote QR code and execute code contained in it. The lesson is not that every QR decoder is malicious; it is that package review must follow data through every decoder, fetcher and interpreter.
Could it steal browser cookies or passwords?
The payload specifically attempted to read document.cookie and locate username and password fields in the document. It then sent the collected values by HTTPS POST only when both a username and a password were available. Olivia Brown summarized the behavior: “If there is both a username and password in the stolen cookie, it sends the information via an HTTPS POST request. Otherwise, it does nothing and exits quietly.”
Rank #3
- 【Battery Level Indicator and 2200mAh Capacity】Larger battery enables longer continuous usage and twice the stand-by time of others. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
- 【Ergonomic Design】 The curved handle is extended and thickened, tailor-made for North America customers. Specially designed smooth and flat trigger for better grip. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1
- 【Anti-Shock Silicone】 The orange anti-shock silicone protective cover can avoid scratches and friction while falling from the height of 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
- 【2.4 GHz Wireless + USB 2.0 Wired Connection】 Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
- 【Digital and Printed 1D 2D QR Bar Code Symbologies】1D: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard25, Matrix 2D: QR, DataMatrix, PDF417, Aztec, Hanxin, Micro PDF417. (Note: Not compatible with Square.)
That behavior creates a conditional risk rather than proof that every installation exposed credentials. Theft depended on the package running in a page context where the targeted data was accessible and present. The available incident reporting does not establish which individual sites, cookies or accounts were successfully captured.
Because the code used document.cookie, cookies protected with the browser’s HttpOnly attribute are not readable through that API. Other script-readable cookies and credentials present in matching form fields could still have been exposed. Treat an affected browser profile as unsafe until sessions and secrets have been replaced.
Rank #4
- 【Unique Designed Screen Setting】It allows you to customize the screen display according to your preferences. With this innovative feature, you can easily set the language, adjust volume settings, select connection options, and view stored and total barcodes. Experience unparalleled convenience and flexibility as you personalize the settings of your Tera HW0009 to suit your specific needs. 【Package Includes: Barcode Scanner x1, Charging Cradle x1, Charging Cable x1, User Manual x1】
- 【Superior Global CMOS Imaging Scanning】This advanced scanner excels in fast and accurate reading of both ordinary and high-density barcodes, including challenging formats like PDF417 found on driver's licenses. Its exceptional performance effortlessly handles various scanning scenarios, including underwater scanning, reading barcodes on silver paper, reflective materials, and more.
- 【Charging Cradle & 2500mAh Large Battery】Designed with a convenient charging cradle, the HW0009 barcode scanner allows you to easily charge it whenever it's not in use. In addition, the scanner itself is equipped with a powerful 2500mAh battery, ensuring seamless all-day operation without the need for frequent charging.
- 【3-in-1 Connections & Widely Compatible】 Tera HW0009 wireless barcode scanner can work with bluetooth & 2.4G wireless & usb wired. The transmission distance can be 328ft in barrier free environment and 114ft in obstacles environment using 2.4G USB dongle. It can be connected with a variety of devices, such as smartphones, computers, POS, tablets. In addition, it is also compatible with various operating systems, such as windows 11/10/8/7/xp, Mac OS, iOS, android, linux.
- 【1D 2D QR code Programmable】2D: QR code, Data Matrix, PDF417(including PDF417 on driver’s license), Aztec, Maxicode, Micro QR, Micro PDF417; 1D: UPC/EAN, Code 128/EAN128, GS1-128, ISBT-128, Standard 2 of 5, Matrix 2 of 5, Code 39, Code 32, Code 93, Code 11, Codabar, PLESSEY, MSI, GSI Databar, ITF-14, GS1.
What to do if you installed fezbox
The GitHub Advisory Database advises treating systems that installed or ran the related malware as fully compromised. Removing the npm package alone may not remove every component or undo credentials that were already copied.
- Isolate the workstation. Disconnect it from production networks and sensitive development systems. Avoid using it to sign in to accounts or publish packages.
- Use a separate clean device. From a computer you trust, rotate npm, GitHub, cloud, browser, SSH, CI/CD and package-publishing credentials. Revoke active sessions, API tokens and keys rather than merely changing a password where the service supports revocation.
- Review browser exposure. Sign out of important services, invalidate sessions, inspect unusual account activity and replace credentials that may have been entered into pages open while the package was active.
- Check development and delivery systems. Review repository secrets, CI/CD variables, cloud access logs, package publication history and recent dependency changes for unauthorized use.
- Preserve evidence. Save the package tarball, lockfile, npm cache, shell history, endpoint logs and network indicators before wiping the machine. Record when the package was installed, imported or executed.
- Rebuild when the boundary is unclear. If you cannot prove what ran and what data was reachable, rebuild the workstation or runner from a known-good image and restore only reviewed source and dependencies.
How teams can reduce the risk of similar packages
Review behavior, not just source text
Inspect install and import scripts, delayed timers, environment checks, dynamic evaluation, decoders and network requests. A package that downloads an image and then parses it deserves the same scrutiny as one that downloads JavaScript.
Recommended Free Tools
Best Value
- 【IP66 Waterproof Dustproof Mini Pocket 2D Scanner】Just bring this scanner with you. Anytime you want to collect data, just connect it with your device via Bluetooth or use the storage mode. 【Package Includes】Barcode Scanner x1, USB Cable x1, Dongle x1, User Manual x1.
- 【Waterproof Dustproof Silicone Port Plug】Newly designed waterproof and dustproof silicone port plug on marketplace, it enables better performance of the scanner in every working conditions. The silicone button on the scanner body enables every soft and smooth scanning experience.
- 【3-in-1 Connection Ways】This scanner works with Bluetooth, 2.4GHz wireless and USB 2.0 wired mode. The transmission distance can be 656ft in barrier free environment and 98 ft in an environment with obstacles using a 2.4G USB dongle. In addition, it is also compatible with various operating systems, such as windows 11/10/8/7/xp, Mac OS, iOS, android, linux.(Note: Not Compatible with Square)
- 【Vibration Alert】: When you need a quiet working environment, just turn the volume off and the vibration function will let you know if a barcode is detected.
- 【1D 2D QR Scanner】：Supports Both Digital and Printed 1D 2D QR Bar Code Symbologies: 1D Decode Capability: Codabar, Code 11, Code93, MSI, Code 128, UCC/EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard 25, 2/5 Matrix 2D Decode Capability: QR, PDF417, Data Matrix, Aztec code, Maxi Code.
Strengthen dependency admission
- Use an allowlist for packages and registries in production builds.
- Pin versions in lockfiles and verify package integrity before promotion.
- Prefer packages with clear maintainer history, repository provenance and signed or attestable releases when available.
- Require a review for new dependencies, transitive additions and changes to install or import behavior.
Add layered scanning
Effective npm dependency security combines static analysis with sandboxed execution, network telemetry and inspection of encoded content. Malicious package scanning should decode QR and image payloads when a package contains the relevant libraries, not stop at readable JavaScript. Runtime controls should alert on unexpected outbound requests, browser data access and credential harvesting.
Limit blast radius
Run builds and tests with minimal network access and short-lived credentials. Keep production secrets out of developer browsers and ordinary build jobs, and separate package-publishing privileges from application deployment privileges. These controls support broader software supply-chain security even when a malicious dependency bypasses an initial review.
Bottom line
fezbox demonstrated that malware can hide in a medium that looks like an ordinary image while using delayed execution and obfuscation to evade inspection. The package’s documented behavior was conditional, but an installation or run is serious enough to warrant isolation, credential rotation from a clean device, evidence preservation and—when necessary—a complete rebuild.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
