fastify-bundler@1.4.14

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

A consumer imports the package and calls getPlugin() (including its default arguments).

Remote code execution with the consuming process's permissions.

Remote payload download followed by Function-based execution.

The exported getPlugin function requests a payload from https://46.183.25.232:45000/icons/105 by default, parses JSON, and passes data.credits to new Function. It invokes that code with require, process, global, Buffer, and timers, allowing the server operator to execute arbitrary code in the caller's Node process.

The package contains a concrete remote code execution loader with a hard-coded, non-package-aligned IP endpoint. Lack of an install hook limits automatic execution but does not remove the exposed malicious execution path.