registry / Remote code execution / @biz44/id99-client
@biz44/id99-client
embedded module for device information collection. Educational and enterprise use.
This report shows the evidence for @biz44/id99-client@1.1.100, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concrete arbitrary code execution.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing the package or calling startLoader.
Impact
Remote operators can run arbitrary JavaScript with the importing application's permissions and leave a background loader process.
Mechanism
Detached remote payload loader using base64 decoding and Function execution.
Attack narrative
A normal import calls initialize(), which spawns loader.js as a detached process, suppresses its standard streams, and writes a PID marker. The loader downloads JSON from a fixed remote endpoint, extracts a base64 code field, decodes it, and invokes it through Function with require, module, and local path context. This is a complete remote code execution channel in the consumer environment, with detached-process persistence.
AI rationale
The package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concrete arbitrary code execution.
Evidence
index.jsinit.jsloader.js.pid
Network endpoints1
api.npoint.io/24c12c4b66a29747764f
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the package immediately calls its initializer.
- The initializer creates a detached, unreferenced Node process and records its PID.
- The loader fetches code from a remote endpoint, base64-decodes it, and executes it with require access.
- The remote code executes in the consumer environment with module and filesystem path context.
Evidence against
- There is no npm install lifecycle hook; execution begins on import.
Behavioral surface
ChildProcessEvalFilesystemNetworkShell
UrlStrings
Source & flagged code
7 flagged · loading sourceinit.jsView file
1import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
High
1Cross-file remote execution chain: init.js spawns loader.js; helper contains network access plus dynamic code execution.
L1: import { spawn } from 'child_process';
L2: import { dirname, join } from 'path';
...
L5:
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: const PID_FILE = join(__dirname, '.pid');
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
init.jsView on unpkg · L1loader.jsView file
1import https from "https";
L2: import { fileURLToPath } from "url";
...
L7: const __filename = fileURLToPath(import.meta.url);
L8: const __dirname = dirname(__filename);
L9: const require = createRequire(import.meta.url);
...
L12:
L13: // Intercept child_process require calls for Windows compatibility
L14: const originalRequire = Module.prototype.require;
...
L22: module.spawn = function(cmd, args, options = {}) {
L23: if (process.platform === "win32" && !options.windowsHide) {
L24: options.windowsHide = true;
...
L31: const { spawnSync } = require('child_process');
Findings
7 High1 Medium4 Low
HighChild Processinit.js
HighShell
HighSandbox Evasion Gated Capabilityloader.js
HighCross File Remote Execution Contextinit.js
HighKnown Malware Source Similarityloader.js
HighKnown Malware Source Fingerprint Signatureloader.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowEvalloader.js
LowFilesystem
LowUrl Strings
Affected versions and remediation
This report applies to @biz44/id99-client@1.1.100.
The versions list below shows the verdict for each recorded version.
- Avoid installing @biz44/id99-client@1.1.100. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.