copytrade-core@2.3.0

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Consumer invokes the default getPlugin export.

Remote attacker can run arbitrary Node.js code with the consuming process's permissions.

Remote response body executed through Function constructor.

A caller of the default export triggers a fetch to a hard-coded IP address. The package extracts data.credits from the JSON response and uses it as the body of a Function constructor, then invokes it with require, process, global, and other Node globals. The endpoint operator can therefore supply arbitrary code that runs with the host application's permissions.

This is a concrete remote-code-execution chain, not merely a dynamic-evaluation primitive. Lack of install hooks limits automatic activation but does not remove the malicious runtime payload loader.