process-mite@1.1.79

Summary

On import of the package main, index.js auto-invokes an initialize() routine that spawns a detached node loader.js process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the code field of the returned JSON, and executes the decoded string via new Function("require","__dirname","__filename","module","exports", decodedCode)(...), granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.

Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191)