MAL-2026-16253 Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.

On import, index.js unconditionally calls initialize(), which spawns loader.js as a detached, unref'd, stdio-suppressed child process (windowsHide:true) and writes a.pid file to enforce singleton persistence. loader.js issues an HTTPS GET to https://api.npoint.io/641d37178a880b1e8b8f — a free anonymous JSON-hosting service whose content is fully mutable by whoever holds the bin's edit token — base64-decodes the code field of the JSON response, and executes it via new Function('require','__dirname','__filename','module','exports', decodedCode), granting the fetched bytes full Node privileges including require. The package's declared identity is a cover story: package.json describes laycot as 'all pro layout cat visible smooth' with education/advanced-testing keywords, the README presents it as runtime-utils/image-utils with a fake getProcessInfo API, and the fetch URL is stored in a variable named API_KEY to obscure that it is an HTTP endpoint. The shipped code has no functionality matching any of these descriptions; its sole runtime behavior is the remote-fetch-and-eval loader.