id79-client@1.1.79

Analysis

id79-client@1.1.79 is a remote-code-execution dropper. Importing the package auto-runs init.js, which spawns a detached background `node loader.js` process (persisted via a .pid file) that outlives the parent. loader.js makes an HTTPS GET to hxxps://api[.]npoint[.]io/24c12c4b66a29747764f, reads a base64-encoded `code` field from the JSON response, decodes it, and executes it via the Function constructor with require/__dirname/__filename/module/exports in scope. The actual payload is served remotely from the npoint[.]io endpoint and is not shipped in the tarball, so the executed code is fully attacker-controlled at runtime.