Calling the default export downloads JavaScript-shaped content from a hard-coded IP endpoint and executes it with Node capabilities. This is a remote code execution loader.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Consumer calls the default-exported getPlugin function.
Impact
A server operator can run arbitrary code in the consuming process.
Mechanism
Fetches data.credits and executes it via Function with require and process.
Attack narrative
At runtime, a caller of the default export causes index.js to fetch JSON from a hard-coded external IP. The package supplies data.credits from that response as the body of a Function constructor, then invokes it with require, process, globalThis, Buffer, and runtime path values. The endpoint can therefore deliver arbitrary Node code after publication without changing the package.
Rationale
The code implements a remote, server-controlled payload loader with full Node process access. Lack of automatic import or install execution limits triggering but does not remove the concrete malicious capability.
Network endpoints1
46.183.25.232:45000/icons/109