@biz44/id10-client@1.1.11

Analysis

Remote-code-execution dropper. Importing the package auto-spawns a detached background 'node loader.js' process (PID persisted to a .pid file) that fetches a remote configuration from hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, base64-decodes the 'code' field, and executes it via the Function constructor with require/__dirname/__filename/module/exports supplied — so the actual payload is served remotely and never shipped in the tarball. The loader also monkey-patches Module.prototype.require to intercept child_process spawn/execSync calls. The remote endpoint is the command-and-control channel; the executed payload is fully attacker-controlled.