process-mite@1.1.79

Analysis

process-mite@1.1.79 executes remote code on import. Importing the package auto-runs an initializer that spawns a detached background `node loader.js` process (persisting its PID to a .pid file). loader.js fetches a JSON document from hxxps://api[.]npoint[.]io/33e8d008c334b060adad, base64-decodes the `code` field, and executes it via the Function constructor with require/__dirname/__filename/module/exports supplied — a remote-code-execution dropper whose payload is served remotely rather than shipped in the package. The package also monkey-patches Module.prototype.require to intercept child_process calls. The remote payload is not present in the tarball, so its full behaviour is determined by the fetched code.