A call to the default export downloads JavaScript from a hard-coded IP endpoint and executes it. The payload receives Node capabilities including require and process.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Consumer invokes the default export getPlugin().
Impact
Remote operator can run arbitrary Node.js code in the consuming process.
Mechanism
Hard-coded remote payload download followed by Function-based execution.
Attack narrative
At runtime, getPlugin() requests a hard-coded IP endpoint with its default token. It reads data.credits from the JSON response, compiles it with new Function, and invokes it with require, process, global, and Buffer. The endpoint operator therefore controls arbitrary code executed in the caller's Node process.
Rationale
The package is an explicit staged remote-code loader, not a checkout or analytics implementation. Lack of install hooks limits automatic activation but does not remove the concrete RCE capability when its export is used.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
46.183.25.232:45000/icons/112