MAL-2026-16173 Malicious code in id79-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.

On import, index.js calls initialize() which spawns a detached, stdio-suppressed node loader.js child process. loader.js issues an HTTPS GET to https://api.npoint.io/24c12c4b66a29747764f, base64-decodes the code field of the response, and executes it via new Function(require, __dirname, __filename, module, exports, decodedCode) — arbitrary code from a third-party mutable JSON hosting bin runs with full Node privileges on the installer's machine. loader.js additionally monkey-patches Module.prototype.require so any subsequent require('child_process').spawn/execSync call is rewritten to force windowsHide:true and route execSync through a hidden cmd.exe /c spawnSync, ensuring commands issued by the remotely fetched payload run invisibly on Windows. The detached-and-unref'd child, suppressed stdio, and stealth child_process wrapper are consistent with a persistent covert loader whose actual behavior is controlled by whoever owns the npoint bin.