The 'process-mite' npm package version 1.1.79 contains malicious code that automatically launches a detached Node.js loader process upon import. This loader retrieves a base64-encoded JavaScript payload from a hardcoded, user-editable JSON endpoint on npoint.io, decodes it, and executes it with full Node.js privileges. The payload communicates with an attacker-controlled server and implements clipboard data collection, keyboard and mouse event logging, filesystem scanning, and theft of Chrome extension storage data. The package's metadata and README misrepresent its functionality as a runtime utility, serving as a cover for the embedded remote code execution client.

Systems that import this package and execute its code are at risk of remote code execution controlled by an attacker. The attacker can exfiltrate sensitive data including clipboard contents, user input events, filesystem information, and Chrome extension storage. This compromises confidentiality and potentially integrity of the affected host environment.

No official patch or remediation is currently documented. Users should immediately cease using the 'process-mite' package version 1.1.79 and remove it from their environments. Avoid installing packages from untrusted sources or accounts. Monitor for suspicious detached Node.js processes and network connections to unknown endpoints. Since the malicious payload is fetched dynamically from a mutable endpoint, blocking network access to the specified URL (https://api.npoint.io/33e8d008c334b060adad) can mitigate execution of the remote payload. Verify all dependencies before installation to prevent supply chain compromise.