async-mutex-lock@5.3.1

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

A consumer imports the package and invokes its default export.

Remote code execution in the consuming application's Node process.

Remote payload fetch followed by Function-based execution.

The advertised mutex package instead exports getPlugin. On invocation it retrieves JSON from a hard-coded IP address, takes data.credits, compiles it with new Function, and executes it with require, process, global, Buffer, timers, and module context. The remote server can therefore supply arbitrary Node.js code to run in the caller's process.

This is a concrete remote-code-execution loader unrelated to the documented mutex functionality. Lack of lifecycle hooks does not mitigate execution when the exported API is called.