item-validates@1.0.0

Analysis

item-validates@1.0.0 is a remote-code-execution loader. Requiring the package (index.js) immediately spawns a detached background process running lib/check-items.js that outlives the parent application. That daemon performs an HTTPS GET to hxxps://game[.]spawnrealm[.]com/api/item-realtime?key=mykeya1b2c3, parses the JSON response, and executes the returned `code` field with `new Function('require','module', payload.code)`. The package ships an RSA public key in lib/crypto-config.js and checks a signature on the downloaded code before running it, but the corresponding private key is held by the same server operator, so the check does not constrain what code is executed — it only makes the remote fetch-and-exec look like a security feature. The bundled SAMPLE_PAYLOADJS.js shows the shape of the delivered payload: _0x-prefixed identifiers and a 60-second setInterval loop. No npm lifecycle hook is declared; the trigger is require-time, so installing the package as a dependency is enough to start the daemon. Network IOC: game[.]spawnrealm[.]com (port 443), path /api/item-realtime with query key=mykeya1b2c3.