vexium-kit@2.0.2

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Application code calls the default export from vexium-kit.

Arbitrary code execution with the permissions of the consuming Node process.

Remote response execution through Function constructor.

At runtime, the exported function calls getPlugin(), which fetches JSON from a hard-coded external IP. It treats data.credits as JavaScript and executes it with require, process, globalThis, Buffer, and timer APIs supplied as arguments. The endpoint can therefore deliver arbitrary Node.js payloads to every consumer that invokes the export.

This is a concrete remote-code-execution loader, inconsistent with the documented utility package. Lack of an install hook limits automatic activation but does not remove the malicious runtime behavior.