Darkroom: malware hidden in a photo

A payload inside the package’s photo

Darkroom investigates malicious npm packages posing as environment-variable loaders. Their payload was concealed inside a JPEG shipped with the package, and execution began when the package was imported rather than through an install script.

The Apiiro article connects the loader to fake exploit repositories used for distribution. It traces package lineage, delivery repositories, payload stages, and shared indicators, with code excerpts and diagrams.