MAL-2026-16224 Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.

On import of the package main, index.js auto-invokes an initialize() routine that spawns a detached node loader.js process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the code field of the returned JSON, and executes the decoded string via new Function("require","__dirname","__filename","module","exports", decodedCode)(...), granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.