@biz44/id95-client@1.1.96

Analysis

Remote-code-execution dropper. Importing the package auto-spawns a detached background `node loader.js` process (PID persisted to a .pid file). loader.js fetches a remote JSON config from hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, base64-decodes the `code` field, and executes it via the Function constructor with full require/__dirname/__filename access — arbitrary remote code execution on the installer's machine. It also monkey-patches Node's Module.prototype.require to intercept child_process calls and force hidden windows on Windows. The remote payload is served at runtime, not shipped in the tarball.