@biz44/id99-client@1.1.100

Analysis

@biz44/id99-client@1.1.100 executes remote code on import. Importing the package (index.js) automatically spawns a detached background `node loader.js` process (PID persisted to a .pid file). loader.js performs an HTTPS GET to hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, reads the `code` field from the returned JSON, base64-decodes it, and executes the decoded string via the Function constructor with require/__dirname/__filename/module/exports in scope — a remote-code-execution dropper whose payload is served remotely rather than shipped in the tarball. It also monkey-patches Module.prototype.require to intercept child_process spawn/execSync calls. The remote endpoint fully controls what code runs on the host.