wallet-analytics@1.4.8

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Consumer calls the default-exported getPlugin function.

A server operator can run arbitrary code in the consuming process.

Fetches data.credits and executes it via Function with require and process.

At runtime, a caller of the default export causes index.js to fetch JSON from a hard-coded external IP. The package supplies data.credits from that response as the body of a Function constructor, then invokes it with require, process, globalThis, Buffer, and runtime path values. The endpoint can therefore deliver arbitrary Node code after publication without changing the package.

The code implements a remote, server-controlled payload loader with full Node process access. Lack of automatic import or install execution limits triggering but does not remove the concrete malicious capability.