electron-device-id@1.0.3

Analysis

This release (index.js, javascript-obfuscator string-array form) adds a remote code download-and-execute path on top of the machine-id/license-gate base. In its checkData() routine it atob-decodes a hardcoded HTTPS endpoint (host begins hxxps://api[.]npo[.][.]. , assembled from split base64 fragments), fetches JSON from it, base64-decodes the response "dd" field, JSON-parses it, and when the object field a matches an expected marker it builds new Function(obj.b) and immediately invokes it, executing attacker-supplied JavaScript. It also installs cookie-based persistence: setData()/getData() write and read values via document.cookie with an expiry, and a document DOMContentLoaded handler runs (after a 1s setTimeout) getData()->checkData() to fetch and execute on every page load in a browser/Electron context. require strings (child_process, crypto) and the endpoint are split-concatenated to evade static analysis. Concrete IOC: remotely fetched JS executed via new Function from a base64-hidden hxxps://api[.]npo[.][.]. endpoint.