MAL-2026-16173

Dashboard / Malicious Package / MAL-2026-16173

MAL-2026-16173

Summary: Malicious code in id79-client (npm)

Details: This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage. Source: amazon-inspector (8e7016cebc45328009f3b55af011e7d5d4db068ea04d85602cac0aeafbe3637e) On import, index.js calls initialize() which spawns a detached, stdio-suppressed `node loader.js` child process. loader.js issues an HTTPS GET to https://api.npoint.io/24c12c4b66a29747764f, base64-decodes the `code` field of the response, and executes it via `new Function(require, __dirname, __filename, module, exports, decodedCode)` — arbitrary code from a third-party mutable JSON hosting bin runs with full Node privileges on the installer's machine. loader.js additionally monkey-patches `Module.prototype.require` so any subsequent `require('child_process').spawn`/`execSync` call is rewritten to force `windowsHide:true` and route execSync through a hidden `cmd.exe /c` spawnSync, ensuring commands issued by the remotely fetched payload run invisibly on Windows. The detached-and-unref'd child, suppressed stdio, and stealth child_process wrapper are consistent with a persistent covert loader whose actual behavior is controlled by whoever owns the npoint bin.

References: