swnwall@1.2.10

Analysis

swnwall@1.2.10 executes remote code on import. Importing the module (index.js) auto-spawns a detached background `node loader.js` process (persistence via a .pid file). loader.js fetches a JSON payload from hxxps://api[.]npoint[.]io/641d37178a880b1e8b8f, base64-decodes the `code` field, and executes it via the Function constructor with full require/module context — a fully attacker-controlled second stage with no payload shipped in the package. The package also monkeypatches child_process.spawn/execSync to force windowsHide. The declared purpose ("Special layout set module") does not match this behaviour.