Loading npm security reports…

@biz44/id99-client@1.1.100: Malicious npm security report (Block) | LPM Firewall

registry / @biz44/id99-client / 1.1.100

@biz44/id99-client@1.1.100

embedded module for device information collection. Educational and enterprise use.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

On package import, it starts a detached loader. The loader retrieves attacker-controlled code from a remote endpoint and executes it in the consumer's Node process context.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the package or calling startLoader.

Impact

Remote operators can run arbitrary JavaScript with the importing application's permissions and leave a background loader process.

Mechanism

Detached remote payload loader using base64 decoding and Function execution.

Attack narrative

A normal import calls initialize(), which spawns loader.js as a detached process, suppresses its standard streams, and writes a PID marker. The loader downloads JSON from a fixed remote endpoint, extracts a base64 code field, decodes it, and invokes it through Function with require, module, and local path context. This is a complete remote code execution channel in the consumer environment, with detached-process persistence.

AI rationale

The package implements an import-triggered detached remote-code loader rather than a bounded client feature. Its remote payload receives Node module-loading capability, establishing concrete arbitrary code execution.

Evidence

index.jsinit.jsloader.js.pid

Network endpoints1

api.npoint.io/24c12c4b66a29747764f

OSV advisory

Source & flagged code

7 flagged

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

1Cross-file remote execution chain: init.js spawns loader.js; helper contains network access plus dynamic code execution. L1: import { spawn } from 'child_process'; L2: import { dirname, join } from 'path'; ... L5: L6: const __dirname = dirname(fileURLToPath(import.meta.url)); L7: const PID_FILE = join(__dirname, '.pid');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

loader.jsView file

1import https from "https"; L2: import { fileURLToPath } from "url"; ... L7: const __filename = fileURLToPath(import.meta.url); L8: const __dirname = dirname(__filename); L9: const require = createRequire(import.meta.url); ... L12: L13: // Intercept child_process require calls for Windows compatibility L14: const originalRequire = Module.prototype.require; ... L22: module.spawn = function(cmd, args, options = {}) { L23: if (process.platform === "win32" && !options.windowsHide) { L24: options.windowsHide = true; ... L31: const { spawnSync } = require('child_process');

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @biz44/id10-client@1.1.11 matchedPath = loader.js matchedIdentity = npm:QGJpejQ0L2lkMTAtY2xpZW50:1.1.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

loader.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = bfc89e0270cec7b1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @biz44/id10-client@1.1.11 matchedPath = loader.js matchedIdentity = npm:QGJpejQ0L2lkMTAtY2xpZW50:1.1.11 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

loader.jsView on unpkg

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the package immediately calls its initializer.

index.jsView on unpkg · L12

Source & flagged code

7 flagged · loading source

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

loader.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

loader.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

loader.jsView on unpkg

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the package immediately calls its initializer.

index.jsView on unpkg · L12

Source & flagged code

7 flagged

init.jsView file

1import { spawn } from 'child_process'; L2: import { dirname, join } from 'path';

High

Child Process

Package source references child process execution.

init.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

init.jsView on unpkg · L1

loader.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

loader.jsView on unpkg · L1

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

loader.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

loader.jsView on unpkg

75L76: new Function("require", "__dirname", "__filename", "module", "exports", decodedCode)( L77: require, __dirname, __filename, module, exports

Low

Eval

Package source references a known benign dynamic code generation pattern.

loader.jsView on unpkg · L75

index.jsView file

12import initialize from './init.js'; // Auto-start on import initialize();

High

Ai Review Evidence

Importing the package immediately calls its initializer.

index.jsView on unpkg · L12

@biz44/id99-client@1.1.100

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code