If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
This package is part of a malicious npm campaign published by the `max233` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.
---
_-= Per source details. Do not edit below this line.=-_
Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191)
On import of the package main, index.js auto-invokes an initialize() routine that spawns a detached `node loader.js` process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes the decoded string via `new Function("require","__dirname","__filename","module","exports", decodedCode)(...)`, granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.
Indicators of compromise
Shown defanged and not clickable. Search any indicator to find other packages using it.
URLs
- hxxps://api[.]npoint[.]io/33e8d008c334b060adad other packages →
- hxxps://api[.]npoint[.]io/37c0a0c68bf7a94ed731 other packages →
- hxxp://103[.]170[.]217[.]184:8787 other packages →
IP addresses
- 103[.]170[.]217[.]184 other packages →