{"id":"MAL-2026-16165","summary":"Malicious code in @biz44/id10-client (npm)","details":"This package is part of a malicious npm campaign published by the `biz44` account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implements clipboard collection, keyboard and mouse event collection, filesystem scanning, and theft of Chrome extension storage.","modified":"2026-09-15T06:30:04.785146002Z","published":"2026-09-12T13:51:46Z","database_specific":{"iocs":{"urls":["https://api.npoint.io/24c12c4b66a29747764f","https://api.npoint.io/37c0a0c68bf7a94ed731","http://103.170.217.184:8787"],"ips":["103.170.217.184"]}},"affected":[{"package":{"name":"@biz44/id10-client","ecosystem":"npm","purl":"pkg:npm/%40biz44/id10-client"},"versions":["1.1.11"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@biz44/id10-client/MAL-2026-16165.json"}}],"schema_version":"1.9.0","credits":[{"name":"ESTsecurity","type":"FINDER"}]}