@biz44/id79-client@1.1.80

Analysis

On import, the package auto-spawns a detached background `node loader.js` process (stdio ignored, PID persisted to a .pid file). The loader makes an HTTPS request to hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, base64-decodes a `code` field from the JSON response, and executes it via `new Function("require", ...)` with full module access — arbitrary remote code execution from a server-controlled payload. It also globally monkey-patches Node's `Module.prototype.require` to intercept `child_process` spawn/execSync calls made by the host application, forcing windowsHide and re-routing execSync through cmd.exe on Windows.