{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "loader.js",
              "sha256": "7e6fb265ff2dc482d050c347751d71b672b187d95ee2d6d567e73ca78d4fedac",
              "tlsh": "265130e609fb2212027770e6bb0b596a96bba113314ec994ba9cc3d45fc2421d2d32dc"
            },
            {
              "path": "index.js",
              "sha256": "11e427eb46163ba1735199f2294e57259403a0a784bc3ba11f410c38ae48d303",
              "tlsh": "a6f0ac4b10832723855bf3969652d0c00a7a8a1c3a44ba02481f52bd0f840958356f53"
            }
          ],
          "package_integrity": [
            {
              "filename": "process-mite-1.1.79.tgz",
              "hashes": {
                "sha1": "180d464884ebda03b77540667b9c9204269f12ff",
                "sha512_sri": "sha512-PMvdBGeAYd0b3xKJkGXPgkipgOiUvTMi1FWD7zC3SoI24elgHiqCk8UHTvpgpUA+HjOCpRuN2O62EBsBts9NzQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "process-mite"
      },
      "versions": [
        "1.1.79"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020110",
        "import_time": "2026-09-16T14:19:38.56712658Z",
        "modified_time": "2026-09-16T14:10:43Z",
        "sha256": "4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191",
        "source": "amazon-inspector",
        "versions": [
          "1.1.79"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4763fac30373bc805351d0eb8e0989cde9dcd2ab2c1b18f9eb7bde4e61765191)\nOn import of the package main, index.js auto-invokes an initialize() routine that spawns a detached `node loader.js` process. loader.js performs an HTTPS GET against the hardcoded endpoint https://api.npoint.io/33e8d008c334b060adad, base64-decodes the `code` field of the returned JSON, and executes the decoded string via `new Function(\"require\",\"__dirname\",\"__filename\",\"module\",\"exports\", decodedCode)(...)`, granting the fetched payload full Node.js capabilities on the installer\u0027s host. npoint.io is a user-editable JSON hosting service, so the executed code is mutable by whoever controls the note and is unpinned and unverified. package.json and README present the package as a \u0027runtime-utils\u0027 library exporting getRuntimeInfo, but no such API is shipped; the advertised purpose is a cover story for the dropper. In-source comments self-describe the module as an embedded remote-code-execution client.\n",
  "id": "MAL-2026-16224",
  "modified": "2026-09-16T14:10:43Z",
  "published": "2026-09-16T14:10:43Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/process-mite/v/1.1.79"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in process-mite (npm)"
}