registry / process-mite / 1.1.79

process-mite@1.1.79

Utilities for working with runtime and system information.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Importing the package starts a detached loader. The loader retrieves and executes attacker-controlled remote JavaScript with Node module-loading access.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

An application imports the package main entry point.

Impact

A remote endpoint can execute arbitrary code in the importing application's user context and leave a background process running.

Mechanism

Detached remote payload loader using HTTPS, base64 decoding, and Function execution.

Attack narrative

A consumer import calls initialize automatically. It launches loader.js detached and writes a PID file. The loader fetches JSON from a remote endpoint, decodes its code field, and executes it through Function while passing require and local path variables. The endpoint therefore controls code run on the consumer host without an explicit runtime action.

AI rationale

This is a concrete remote-code-execution loader activated by a normal import, with persistence-like detached process behavior. The lack of an install hook does not reduce the import-time remote execution risk.

Evidence

index.jsinit.jsloader.js.pid

Network endpoints1

api.npoint.io/33e8d008c334b060adad

OSV advisory

This package is part of a malicious npm campaign published by the `max233` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage. --- ## Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191) On import of the package main, index.js auto-invokes an initialize() routine that spawns a detached `node loader.js` process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes the decoded string via `new Function("require","__dirname","__filename","module","exports", decodedCode)(...)`, granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.

process-mite@1.1.79

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code