Explicit calls to exported plugin functions retrieve attacker-controlled remote content and execute it as JavaScript. The first call can schedule a second payload fetch.
Static reason
One or more suspicious static signals were detected.
Trigger
Consumer invokes getPlugin, setPlugin, or getPluginExten.
Impact
Remote code execution in the consuming Node.js process.
Mechanism
HTTP payload fetch followed by eval(JSON.parse(response)).
Attack narrative
The exported getPlugin, setPlugin, and getPluginExten functions request fixed endpoints at rest-icon-handler.store and pass a JSON-decoded response directly to eval. getPlugin additionally schedules getPluginExten after one minute, enabling a second remote stage. This is remote payload execution unrelated to the documented SVG-fetching purpose.
Rationale
Source establishes a concrete remote-code-execution path when an exported API is called. Absence of lifecycle hooks reduces install-time scope but does not remove the malicious runtime capability.
Evidence
package.jsonindex.jsREADME.md
Network endpoints2
rest-icon-handler.store/icons/103rest-icon-handler.store/icons/389