MAL-2026-16224
Malicious code in process-mite (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191) On import of the package main, index.js auto-invokes an initialize() routine that spawns a detached `node loader.js` process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes the decoded string via `new Function("require","__dirname","__filename","module","exports", decodedCode)(...)`, granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for process-mite (npm). Pin to a known-safe version or switch to an alternative.