fastify-bundler@1.4.15

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Application code calls getPlugin() (including with its defaults).

Arbitrary code execution in the consuming Node.js process.

remote payload download followed by Function-based execution

A consumer invoking getPlugin() causes a request to the hard-coded IP endpoint. The package parses the JSON response and executes data.credits via Function, exposing Node process and module-loading capabilities to attacker-controlled code. This permits arbitrary local actions and subsequent exfiltration or persistence.

This is a concrete remote-code-execution loader, not a legitimate icon fetch path. Lack of lifecycle hooks limits automatic activation but does not remove the malicious exported capability.