MAL-2026-16211

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a) On require/import, index.js invokes initialize() which spawns loader.js as a detached, hidden background child process (detached: true, windowsHide: true, stdio: 'ignore', unref'd) and records a.pid file to avoid re-spawning. loader.js performs an HTTPS GET against https://api.npoint.io/641d37178a880b1e8b8f (a user-editable JSON hosting service), base64-decodes the `code` field of the response, and executes the decoded payload via `new Function("require",..., decodedCode)(require, __dirname, __filename,...)`, granting the fetched code full access to Node's require, filesystem, and process APIs on the installer's machine. loader.js additionally monkey-patches Module.prototype.require to force windowsHide on all child_process spawn calls and reroute execSync through a hidden `cmd.exe /c`, concealing further child-process activity. The remote payload is mutable and attacker-controllable via the npoint.io endpoint.