laycot@1.3.10

Analysis

laycot@1.3.10 is a remote-code-execution dropper. Importing the package automatically spawns a detached background `node loader.js` process (PID persisted to a .pid file). loader.js fetches a remote configuration from hxxps://api[.]npoint[.]io/641d37178a880b1e8b8f, base64-decodes the `code` field from the JSON response, and executes it via the Function constructor with require/__dirname/__filename/module/exports injected. The executed payload is served remotely and is not present in the package, so its behaviour is fully controlled by the remote endpoint. The loader also monkey-patches child_process.spawn/execSync to force windowsHide on Windows. The package makes outbound network contact on execution.