process-lhpm@1.1.79

Analysis

process-lhpm@1.1.79 is a remote-code-execution dropper. Importing the package auto-starts a detached background process (node loader.js) that persists via a PID file. The loader fetches remote content from hxxps://api[.]npoint[.]io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes it via the Function constructor with require/__dirname/__filename/module/exports in scope — giving the remote payload full access to the host. The payload is served remotely and is not shipped in the package, so its behaviour is controlled entirely by the remote endpoint.