The final published version of the malicious pdf-to-office npm package restructures its file layout and swaps its suspicious asar dependency for the benign-sounding pdf-lib in an apparent attempt to reduce scrutiny, while retaining the core wallet-patching payload. Armando identified this evasion attempt in v1.1.2, published April 7, 2025 -- six days after v1.0.2. The Exodus wallet patch (targeting version 25.13.3) is carried as a single 24.3 MB file named lib.js, embedded among legitimate-looking font and encoding files that mimic a real document processing library. The attacker dropped the explicit asar dependency but the patching capability persists.
%22%3E%0A%20%20%20%20%20%20%3Crect%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%23f2930d%22%2F%3E%0A%20%20%20%20%20%20%3Crect%20x%3D%2210%22%20width%3D%2210%22%20height%3D%2220%22%20fill%3D%22%230d0d0d%22%2F%3E%0A%20%20%20%20%3C%2Fpattern%3E%0A%20%20%3C%2Fdefs%3E%0A%20%20%3Crect%20width%3D%221200%22%20height%3D%226%22%20fill%3D%22url(%23caution-stripe)%22%2F%3E%0A%3C%2Fsvg%3E){kind=small}
lib.js)asar (obviously wallet-related) to pdf-lib (plausibly a PDF library); the wallet patch file renamed from e_25_13_3.js to lib.jsThe package presents itself as "A lightweight npm library for converting PDF files to Office." In v1.1.2, the attacker replaced the four-to-six file structure of earlier versions with a 27-file layout that includes font data in compressed JSON format (Helvetica, Courier, Times, Symbol), TypeScript type definitions, and utility modules -- all consistent with what a real PDF library might contain. The declared dependency is now pdf-lib rather than asar, removing the most obvious tell of earlier versions. The package was published by npm account mikeikotin, which has no source repository and no other legitimate packages. Total downloads across all versions are 348; the package has been removed from the npm registry.
The v1.1.2 package carries the Exodus wallet 25.13.3 patch bundle as libs/lib.js (24.3 MB, SHA256: e254d485e9d4a40c8f3e911f71af0a454b7158568e989145ae10891693e552b1). This is the same file that appeared as e_25_13_3.js in v1.0.2 -- identical hash -- just renamed to blend with the rest of the libs/ directory. The explicit orchestrator logic that unpacked and repacked wallet asars (as seen in pdftodoc.js in earlier versions) has been restructured; the v1.1.2 pdftodoc.js is a decoy file that logs Hello World! and nothing else.
The drop of the asar module from the dependency list does not eliminate the attack vector -- it shifts detection surface. The malicious wallet patch is still present and served as a library file. Any project that installs this version and subsequently processes the contents of lib.js as part of a document pipeline, or any attacker-controlled downstream code that requires this package, can leverage the embedded Exodus patch.
The trend across all four versions of pdf-to-office shows progressive camouflage: v1.0.0 and v1.0.1 carried the attack nakedly, v1.0.2 expanded capabilities, and v1.1.2 disguised the payload behind a plausible library structure -- a pattern consistent with an attacker who anticipated detection and was adjusting packaging to survive longer on the registry.
lib.js is the 24.3 MB Exodus wallet 25.13.3 malicious bundle embedded in the package's libs/ directory. Its hash matches e_25_13_3.js from v1.0.2 exactly -- it is the same modified Exodus wallet application bundle, renamed. When deployed as an Exodus wallet replacement, it intercepts seed phrase access and transaction signing to redirect crypto assets to the attacker.
package.json is classified as malicious: it replaces the asar dependency with pdf-lib to improve the package's superficial legitimacy while the 24 MB Exodus patch remains embedded in libs/lib.js.
Developers and security teams should take the following steps:
npm install while this version was current should be considered potentially affected.| Filename | SHA256 | Detection |
|---|---|---|
| lib.js | e254d485e9d4a40c8f3e911f71af0a454b7158568e989145ae10891693e552b1 | Script-JS.Trojan.SupplyChain |
| package.json | a718a2f43f59393376e171cdd48f7142ca528d14a9f39ec698743c333fcd84b7 | Text.Trojan.SupplyChain |
| URL / IP | Purpose |
|---|---|
| None | The v1.1.2 package restructuring removed the explicit orchestrator with C2 callbacks; the Exodus wallet patch embedded in lib.js carries its own internal logic and does not expose plaintext C2 addresses at the package level |
| File | SHA256 |
|---|---|
| pdf-to-office-1.1.2.tgz | e39db817cc4cbc6849f4ac86a1ca6f2f9d87dcdffd9980e5b42c4019cf0277c1 |
| pdf-to-office-1.1.2.tar | 89003b61779bfedd7ef13838eda46312891821ada773a2d57078d5f03ebbe2c2 |