process-mite

{"schema_version":"1.7.4","id":"MAL-2026-16224","published":"2026-09-16T08:40:49Z","modified":"2026-09-16T22:57:53.629118777Z","summary":"Malicious code in process-mite (npm)","details":"This package is part of a malicious npm campaign published by the `max233` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191)\nOn import of the package main, index.js auto-invokes an initialize() routine that spawns a detached `node loader.js` process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes the decoded string via `new Function(\"require\",\"__dirname\",\"__filename\",\"module\",\"exports\", decodedCode)(...)`, granting the fetched payload full Node.js capabilities on the installer's host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a 'runtime-utils' library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.\n","affected":[{"package":{"name":"process-mite","ecosystem":"npm"},"versions":["1.1.79"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"loader.js","sha256":"7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac","tlsh":"265130e609fb2212027770e6bb0b596a96bba113314ec994ba9cc3d45fc2421d2d32dc"},{"path":"index.js","sha256":"11e427eb46163ba1735199f2294e57259403a0a784bc3ba11f410c38ae48d303","tlsh":"a6f0ac4b10832723855bf3969652d0c00a7a8a1c3a44ba02481f52bd0f840958356f53"}],"package_integrity":[{"filename":"process-mite-1.1.79.tgz","hashes":{"sha1":"180d464884ebda03b77540667b9c9204269f12ff","sha512_sri":"sha512-PMvdBGeAYd0b3xKJkGXPgkipgOiUvTMi1FWD7zC3SoI24elgHiqCk8UHTvpgpUA+HjOCpRuN2O62EBsBts9NzQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/process-mite/v/1.1.79"}],"database_specific":{"iocs":{"ips":["103.170.217.184"],"urls":["https://api.npoint.io/33e8d008c334b060adad","https://api.npoint.io/37c0a0c68bf7a94ed731","http://103.170.217.184:8787"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-020110","import_time":"2026-09-16T14:19:38.56712658Z","modified_time":"2026-09-16T14:10:43Z","sha256":"4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191","source":"amazon-inspector","versions":["1.1.79"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ESTsecurity","type":"FINDER"}]}