MAL-2026-16261 Malicious code in @railone/image-utils (npm)

On import, index.js calls initialize() which spawns a detached, stdio-suppressed, windowsHide node loader.js child (init.js) and records its PID. loader.js HTTPS-fetches JSON from https://api.npoint.io/641d37178a880b1e8b8f, base64-decodes the code field, and executes it via new Function('require','__dirname','__filename','module','exports', decodedCode)(...), running arbitrary attacker-controlled JavaScript on the installer's host with full Node privileges and network access. The npoint.io endpoint is a mutable third-party JSON store whose contents can be changed at any time by whoever controls that resource, giving that party a persistent remote code-push channel into every installer. The package advertises itself as an image/runtime utility exposing getProcessInfo/getRuntimeInfo, but no such functions are exported; internal comments identify the code as an 'ID-10 Client Module' for 'device information collection and remote code execution' with 'AUTO-START ON IMPORT'.