laycot

{"schema_version":"1.7.4","id":"MAL-2026-16253","published":"2026-09-16T23:57:52Z","modified":"2026-09-18T01:03:27.477747221Z","summary":"Malicious code in laycot (npm)","details":"This package is part of a malicious npm campaign published by the `laycot` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (888eb7470e3887d76a6ecd9ccb3c635fac2e5c9c2726550b2047f7e52d6c6062)\nOn import, index.js unconditionally calls initialize(), which spawns loader.js as a detached, unref'd, stdio-suppressed child process (windowsHide:true) and writes a.pid file to enforce singleton persistence. loader.js issues an HTTPS GET to https://api.npoint.io/641d37178a880b1e8b8f — a free anonymous JSON-hosting service whose content is fully mutable by whoever holds the bin's edit token — base64-decodes the `code` field of the JSON response, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)`, granting the fetched bytes full Node privileges including `require`. The package's declared identity is a cover story: package.json describes laycot as 'all pro layout cat visible smooth' with education/advanced-testing keywords, the README presents it as `runtime-utils`/`image-utils` with a fake `getProcessInfo` API, and the fetch URL is stored in a variable named `API_KEY` to obscure that it is an HTTP endpoint. The shipped code has no functionality matching any of these descriptions; its sole runtime behavior is the remote-fetch-and-eval loader.\n","affected":[{"package":{"name":"laycot","ecosystem":"npm"},"versions":["1.3.10"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"loader.js","sha256":"98602aca3efb91d6f77d4f3d0283681f1a954821885259b70127a66eb34fa7e4","tlsh":"d35143a609fb35120277b0e6b70b596a96bba113314ec994fa9cc3d44fc2421d3d32dc"},{"path":"index.js","sha256":"68a53a63f724339e9a5231f7ef0c5b72101c98b37731ec4c78530cce625e9272","tlsh":"a8f0ac5b10832723855be3969662d0c00a7a8a0c3644ba02581f52bd0f840998356f57"},{"path":"README.md","sha256":"c467b72dfe95fca6ee1a72fc359cca6fcaba8e446687a6ca595b86a4a2c57fb9","tlsh":"19f09e1eae75ba17219b134b3efb54964efec5fa1011d05c6c9e40bc9253593431e278"}],"package_integrity":[{"filename":"laycot-1.3.10.tgz","hashes":{"sha1":"35d08b4b0e988ee388701f78c4a712590b00f1f9","sha512_sri":"sha512-0PZUBETXe5Wgga6kfp449KwQE4rPZU0RN/mJw6laYTWSiFv4bcmJEaqgZ7BT5Gab7tG/7cuEsgT7UazraR4ZXg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/laycot/v/1.3.10"}],"database_specific":{"iocs":{"ips":["103.170.217.184"],"urls":["https://api.npoint.io/641d37178a880b1e8b8f","https://api.npoint.io/37c0a0c68bf7a94ed731","http://103.170.217.184:8787"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-020132","import_time":"2026-09-17T15:18:28.931756036Z","modified_time":"2026-09-17T14:47:45Z","sha256":"888eb7470e3887d76a6ecd9ccb3c635fac2e5c9c2726550b2047f7e52d6c6062","source":"amazon-inspector","versions":["1.3.10"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"ESTsecurity","type":"FINDER"}]}