MAL-2026-16253

Dashboard / Malicious Package / MAL-2026-16253

MAL-2026-16253

Summary: Malicious code in laycot (npm)

Details: This package is part of a malicious npm campaign published by the `laycot` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage. Source: amazon-inspector (888eb7470e3887d76a6ecd9ccb3c635fac2e5c9c2726550b2047f7e52d6c6062) On import, index.js unconditionally calls initialize(), which spawns loader.js as a detached, unref'd, stdio-suppressed child process (windowsHide:true) and writes a.pid file to enforce singleton persistence. loader.js issues an HTTPS GET to https://api.npoint.io/641d37178a880b1e8b8f — a free anonymous JSON-hosting service whose content is fully mutable by whoever holds the bin's edit token — base64-decodes the `code` field of the JSON response, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)`, granting the fetched bytes full Node privileges including `require`. The package's declared identity is a cover story: package.json describes laycot as 'all pro layout cat visible smooth' with education/advanced-testing keywords, the README presents it as `runtime-utils`/`image-utils` with a fake `getProcessInfo` API, and the fetch URL is stored in a variable named `API_KEY` to obscure that it is an HTTP endpoint. The shipped code has no functionality matching any of these descriptions; its sole runtime behavior is the remote-fetch-and-eval loader.

References: https://www.npmjs.com/package/laycot/v/1.3.10