@biz44/runtime-utils@1.1.11

Analysis

Remote-code-execution dropper. Importing the package auto-runs an initializer that spawns a detached background `node loader.js` process (tracked via a .pid file). loader.js makes an HTTPS request to hxxps://api[.]npoint[.]io/641d37178a880b1e8b8f, reads a base64-encoded `code` field from the JSON response, decodes it, and executes it with full `require` access via the Function constructor, giving the remote server arbitrary code execution on the host. The package also monkey-patches Node's module loader to intercept child_process calls. The executed payload is served remotely and is not present in the tarball.