@biz44/id44-client@1.1.44

Analysis

@biz44/id44-client@1.1.44 is a remote-code-execution dropper. Importing the package immediately spawns a detached background `node loader.js` process (init.js, detached:true, unref'd, PID tracked in a .pid file). loader.js fetches a JSON document from hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, reads the `code` field, base64-decodes it, and executes it via `new Function("require","__dirname","__filename","module","exports", decodedCode)`, giving the remotely-served payload full Node.js require/module access. The executed payload is served remotely and is not present in the package, so its behaviour is fully attacker-controlled at runtime. The package auto-starts this on import with no opt-in.