fastify-bundler@1.4.16

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

A consumer imports the package and calls getPlugin().

Remote code execution in the consuming Node process.

remote payload fetch followed by Function-constructor execution

The exported getPlugin function requests a payload from the hard-coded 31.97.137.157 server, parses JSON, and executes data.credits through new Function. The payload receives require, process, globalThis, Buffer, and timer APIs, enabling arbitrary code execution with the permissions of the application that invokes it.

This is a concrete remote-code-execution loader, not a normal resource fetcher. Lack of an install hook limits activation to runtime, but does not remove the malicious execution chain.