A caller invoking the default export triggers retrieval and execution of remote JavaScript. The fetched code receives powerful Node globals, including require and process.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Consumer imports the package and calls its default export.
Impact
Remote code execution in the consuming application's Node process.
Mechanism
Remote payload fetch followed by Function-constructor execution.
Attack narrative
index.js exports getPlugin. When called, it fetches JSON from a hard-coded IP address and passes data.credits directly to new Function. The remote code is invoked with require, process, global, Buffer, and timer APIs, enabling arbitrary actions in the host process.
Rationale
This is a concrete staged remote-code-execution mechanism, not a benign CDN fetch. Lack of automatic invocation reduces reachability but does not remove the malicious capability exposed by the package.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
31.97.137.157:45000/icons/112