@biz44/runtime-utils

{"modified":"2026-09-14T12:40:21Z","published":"2026-09-14T03:39:58Z","schema_version":"1.7.4","id":"MAL-2026-16172","summary":"Malicious code in @biz44/runtime-utils (npm)","details":"This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.","affected":[{"package":{"ecosystem":"npm","name":"@biz44/runtime-utils"},"versions":["1.1.11","1.1.13","1.1.81","1.1.96","1.1.100"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"credits":[{"name":"ESTsecurity","type":"FINDER"}],"database_specific":{"iocs":{"ips":["103.170.217.184"],"urls":["https://api.npoint.io/641d37178a880b1e8b8f","https://api.npoint.io/33e8d008c334b060adad","https://api.npoint.io/933a731a5e97f4b45249","https://api.npoint.io/24c25d5f5fcbb0992a4f","https://api.npoint.io/ddae72efbb6714fae922","https://api.npoint.io/37c0a0c68bf7a94ed731","http://103.170.217.184:8787"]}}}