registry / Remote code execution / @biz44/id44-client
@biz44/id44-client
embedded module for device information collection. Educational and enterprise use.
This report shows the evidence for @biz44/id44-client@1.1.44, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not mitigate the runtime attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package's main entrypoint.
Impact
The remote endpoint can run arbitrary code with the importing application's privileges and maintain a background process.
Mechanism
Detached remote payload download and Function-based execution.
Attack narrative
A normal application import calls initialize. It starts loader.js as a detached process with hidden standard streams and writes a PID marker. The loader requests a fixed remote endpoint, decodes its code field from base64, and passes it to Function with require, module paths, and exports. The endpoint therefore controls code executed under the host application's privileges.
AI rationale
This is concrete remote code execution activated by an ordinary import, combined with detached-process persistence and process-hiding behavior. The lack of an npm lifecycle hook does not mitigate the runtime attack.
Evidence
index.jsinit.jsloader.js.pid
Network endpoints1
api.npoint.io/24c12c4b66a29747764f
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the main entry automatically starts initialization.
- Initialization launches a detached, hidden loader and records its PID.
- The loader fetches a remote response from api.npoint.io.
- Remote base64 data is executed with Function and receives require.
- The loader globally intercepts child_process loading and hides Windows processes.
Evidence against
- package.json has no npm preinstall, install, or postinstall lifecycle hook.
Behavioral surface
ChildProcessEvalFilesystemNetworkShell
UrlStrings
Source & flagged code
7 flagged · loading sourceinit.jsView file
1import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
High
1Cross-file remote execution chain: init.js spawns loader.js; helper contains network access plus dynamic code execution.
L1: import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
...
L5:
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: const PID_FILE = join(__dirname, '.pid');
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
init.jsView on unpkg · L135const child = spawn('node', [LOADER], {
stdio: ['ignore', 'ignore', 'ignore'],
windowsHide: true,
shell: false,
cwd: __dirname,
detached: true
});
child.unref();
try {
writeFileSync(PID_FILE, child.pid.toString());
High
Ai Review Evidence
Initialization launches a detached, hidden loader and records its PID.
init.jsView on unpkg · L35Findings
7 High1 Medium4 Low
HighChild Processinit.js
HighShell
HighSandbox Evasion Gated Capabilityloader.js
HighCross File Remote Execution Contextinit.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceinit.js
HighAi Review Evidenceloader.js
MediumNetwork
LowScripts Present
LowEvalloader.js
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @biz44/id44-client@1.1.44.
The versions list below shows the verdict for each recorded version.
- Avoid installing @biz44/id44-client@1.1.44. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.