poly-bbc-service@3.7.2

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Consumer imports the package and invokes its default export.

Arbitrary code execution with the consuming process's privileges.

Remote payload fetch followed by Function-constructor execution.

At runtime, getPlugin fetches JSON from the hard-coded IP endpoint, extracts data.credits, and compiles it with new Function. It invokes that code with require, process, globalThis, Buffer, and timers, allowing the server to supply arbitrary Node.js behavior in the consumer environment. There is no install hook, but the exported runtime function directly implements a remote-code loader.

The package is a concrete remote code execution loader, not a normal API client: its only exported behavior retrieves and executes server-provided code. The documented API does not match the source.