Supply chain · npm · High

Malicious npm package @biz44/process-runtime-utils executes remote code

Threat Engine Auto-Feed · data current as of 2026-09-15

A critical severity malicious package, `@biz44/process-runtime-utils` version 1.1.10, was identified in the npm ecosystem. This package automatically executes remote code upon import, posing a significant supply-chain risk to any project that installed it. Organizations should immediately check for its presence and remove it.

  • Package: npm / @biz44/process-runtime-utils
  • Affected versions: = 1.1.10
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Malicious package

The npm package `@biz44/process-runtime-utils` version 1.1.10 contains malicious code. Upon import, this package automatically launches a detached JavaScript loader that retrieves and executes additional code from a remote server (npoint.io). This activity is part of a broader malicious npm campaign originating from the `biz44` account.

How the attack works

This is a malicious package attack where a seemingly legitimate software component is compromised to deliver a payload. The attack leverages the trust placed in package managers; once the malicious package is installed and imported, it establishes a covert channel to download and execute further attacker-controlled code, bypassing typical security controls by operating within the application's legitimate execution environment.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull the latest package versions
  • Any project that has `biz44/process-runtime-utils` version 1.1.10 as a direct or transitive dependency

Conditions that increase exposure

  • Unpinned or broad dependency versions that allow automatic updates to the malicious version
  • Lack of package lockfiles (e.g., `package-lock.json`, `yarn.lock`) to ensure deterministic builds
  • Use of internal package mirrors that may not have filtered out the malicious version
  • Environments where `npm install` or `yarn install` is run without strict integrity checks

Blast-radius scenarios

  • If the package is installed and imported, an attacker gains remote code execution capabilities on the affected system.
  • The blast radius includes potential data exfiltration (clipboard, keyboard/mouse events, filesystem scans, Chrome extension storage) and further compromise of development or production environments where the package is executed.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` (or equivalent) files for `@biz44/process-runtime-utils` version `1.1.10`.
  • Monitor network traffic for suspicious outbound connections to `npoint.io` or other unknown domains from development or build environments.
  • Review npm audit reports or similar dependency scanning tool outputs for this specific advisory (GHSA-85j9-pqgv-pr94).

Contain

  • Immediately quarantine any systems or build environments found to have installed `@biz44/process-runtime-utils@1.1.10`.
  • Block network access to `npoint.io` from all internal systems.
  • Revoke API keys, tokens, and credentials that may have been exposed on compromised systems.

Remediate

  • Remove `@biz44/process-runtime-utils` version `1.1.10` from all project dependencies.
  • Update `package.json` to specify exact, known-good versions for all dependencies, and regenerate lockfiles.
  • Perform a thorough security audit of any system that executed the malicious package, including checking for persistence mechanisms or further compromise.
  • Educate development teams on supply chain risks and best practices for dependency management.

Frontier verdict — High

Prioritize immediate detection and removal of `@biz44/process-runtime-utils@1.1.10` due to critical remote code execution and data exfiltration capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.