umber-root@1.1.2

The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3 and then invokes `globalThis[data.success](data.id)`, letting the remote endpoint choose which global (eval, Function, require, etc.) to call and with what argument. The package reassigns `globalThis.require = require` earlier in the same file to make `require` reachable through this indirection. The result is arbitrary code execution on every installer machine during `npm install`, with both the executor and its argument supplied by an attacker-controlled Cloudflare Workers endpoint. The package advertises itself as a color toolkit; there is no build or configuration purpose served by a network-dispatched global invocation, and the string-indexed global lookup is an evasion pattern that hides the sink from static scanners.