MAL-2026-16211 Malicious code in swnwall (npm)

On require/import, index.js invokes initialize() which spawns loader.js as a detached, hidden background child process (detached: true, windowsHide: true, stdio: 'ignore', unref'd) and records a.pid file to avoid re-spawning. loader.js performs an HTTPS GET against https://api.npoint.io/641d37178a880b1e8b8f (a user-editable JSON hosting service), base64-decodes the code field of the response, and executes the decoded payload via new Function("require",..., decodedCode)(require, __dirname, __filename,...), granting the fetched code full access to Node's require, filesystem, and process APIs on the installer's machine. loader.js additionally monkey-patches Module.prototype.require to force windowsHide on all child_process spawn calls and reroute execSync through a hidden cmd.exe /c, concealing further child-process activity. The remote payload is mutable and attacker-controllable via the npoint.io endpoint.