alpha-helper@1.3.4

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

A consumer invokes the default export getPlugin().

The endpoint operator can run arbitrary code in the consuming process, including loading modules and accessing process data.

Remote payload fetch followed by Function execution with Node globals.

A call to the exported getPlugin function requests a JSON object from the hard-coded IP endpoint, takes data.credits, compiles it with new Function, and invokes it with require, process, global, Buffer, and runtime path values. The remote server therefore controls code executed in the consumer's Node process.

The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exported API is called.