MAL-2026-16173

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8e7016cebc45328009f3b55af011e7d5d4db068ea04d85602cac0aeafbe3637e)

On import, index.js calls initialize() which spawns a detached, stdio-suppressed node loader.js child process. loader.js issues an HTTPS GET to https://api.npoint.io/24c12c4b66a29747764f, base64-decodes the code field of the response, and executes it via new Function(require, __dirname, __filename, module, exports, decodedCode) — arbitrary code from a third-party mutable JSON hosting bin runs with full Node privileges on the installer's machine. loader.js additionally monkey-patches Module.prototype.require so any subsequent require('child_process').spawn/execSync call is rewritten to force windowsHide:true and route execSync through a hidden cmd.exe /c spawnSync, ensuring commands issued by the remotely fetched payload run invisibly on Windows. The detached-and-unref'd child, suppressed stdio, and stealth child_process wrapper are consistent with a persistent covert loader whose actual behavior is controlled by whoever owns the npoint bin.