MAL-2026-16253

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (888eb7470e3887d76a6ecd9ccb3c635fac2e5c9c2726550b2047f7e52d6c6062) On import, index.js unconditionally calls initialize(), which spawns loader.js as a detached, unref'd, stdio-suppressed child process (windowsHide:true) and writes a.pid file to enforce singleton persistence. loader.js issues an HTTPS GET to https://api.npoint.io/641d37178a880b1e8b8f — a free anonymous JSON-hosting service whose content is fully mutable by whoever holds the bin's edit token — base64-decodes the `code` field of the JSON response, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)`, granting the fetched bytes full Node privileges including `require`. The package's declared identity is a cover story: package.json describes laycot as 'all pro layout cat visible smooth' with education/advanced-testing keywords, the README presents it as `runtime-utils`/`image-utils` with a fake `getProcessInfo` API, and the fetch URL is stored in a variable named `API_KEY` to obscure that it is an HTTP endpoint. The shipped code has no functionality matching any of these descriptions; its sole runtime behavior is the remote-fetch-and-eval loader.