Malicious Package

Overview laycot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in laycot (npm)

Source: amazon-inspector 888eb7470e3887d76a6ecd9ccb3c635fac2e5c9c2726550b2047f7e52d6c6062 On import, index.js unconditionally calls initialize, which spawns loader.js as a detached, unref'd, stdio-suppressed child process windowsHide:true and writes a.pid file to enforce singleton persistence...

Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

MAL-2026-16253 Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...