registry / id79-client / 1.1.79

id79-client@1.1.79

embedded module for device information collection. Educational and enterprise use.

AI Security Review

scanned 24d ago · by lpm-firewall-ai

A normal import starts a detached loader. The loader retrieves attacker-controlled code and executes it with Node capabilities.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing id79-client.

Impact

The remote endpoint can run arbitrary code under the importing application's user account and leave a background process running.

Mechanism

Detached remote payload download and Function-based execution.

Attack narrative

When an application imports the package, index.js invokes initialize. It starts loader.js as a detached process and stores a PID file. The loader fetches JSON from api.npoint.io, decodes its code field from base64, and evaluates it using Function with require and local path variables. This provides the remote endpoint arbitrary code execution in the consumer environment.

AI rationale

This is an import-triggered remote code execution chain with persistence-like detached execution, not a package-aligned client feature.

Evidence

index.jsinit.jsloader.js.pid

Network endpoints1

api.npoint.io/24c12c4b66a29747764f

OSV advisory

OpenSSF/OSV

This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage. --- ## Source: amazon-inspector (8e7016cebc45328009f3b55af011e7d5d4db068ea04d85602cac0aeafbe3637e) On import, index.js calls initialize() which spawns a detached, stdio-suppressed `node loader.js` child process. loader.js issues an HTTPS GET to https://api.npoint.io/24c12c4b66a29747764f, base64-decodes the `code` field of the response, and executes it via `new Function(require, __dirname, __filename, module, exports, decodedCode)` — arbitrary code from a third-party mutable JSON hosting bin runs with full Node privileges on the installer's machine. loader.js additionally monkey-patches `Module.prototype.require` so any subsequent `require('child_process').spawn`/`execSync` call is rewritten to force `windowsHide:true` and route execSync through a hidden `cmd.exe /c` spawnSync, ensuring commands issued by the remotely fetched payload run invisibly on Windows. The detached-and-unref'd child, suppressed stdio, and stealth child_process wrapper are consistent with a persistent covert loader whose actual behavior is controlled by whoever owns the npoint bin.

id79-client@1.1.79

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code