engin1@1.3.99

Analysis

engin1@1.3.99 executes remote code on import. The package's index.js auto-imports init.js, which spawns a detached `node loader.js` child process. loader.js makes an HTTPS request to hxxps://api[.]npoint[.]io/24c25d5f5fcbb0992a4f, reads the `code` field from the JSON response, base64-decodes it, and executes it via the Function constructor with require/__dirname/__filename/module/exports provided. The executed payload is fully attacker-controlled from a third-party JSON hosting service. The package also monkey-patches Module.prototype.require to intercept child_process spawn/execSync calls on Windows. Any code hosted at that endpoint runs on the importing machine.