cors-version@1.0.2

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

A consumer requires src/index.cjs, calls getPlugin(), then invokes the returned function.

Arbitrary code execution in the consuming Node.js process; the payload can access files, processes, and network through require.

HTTPS-fetched payload executed through Function with require

The CommonJS package export includes getPlugin, absent from the ESM entrypoint and type declarations. Its callback fetches an attacker-controlled response from api.avax-test.dev with certificate validation disabled, then executes that response using new Function and passes require. This creates remote arbitrary-code execution whenever the concealed API is invoked.

The CJS entrypoint implements a concealed remote payload loader and executor unrelated to SVG processing. No lifecycle hook is needed for this concrete runtime RCE capability to be malicious.