polygon-gama-apis version 1.4.1 exports a function getPlugin() that fetches JSON from a remote URL and executes the 'credits' field content as JavaScript code with full Node.js privileges. This remote code execution enables the attacker to run arbitrary code within the installer's process. The package uses obfuscation techniques such as splitting the command-and-control URL into fragments and disguising the malicious payload in a field named 'credits'. The package metadata is inconsistent and misleading, aiming to attract installs from multiple ecosystems. Bundled dependencies indicate potential credential and wallet stealing functionality. Removal of the package does not guarantee full remediation due to possible persistent compromise.

Systems with polygon-gama-apis version 1.4.1 installed and running are fully compromised, allowing arbitrary code execution by a remote attacker. This can lead to theft of secrets, credentials, and keys stored on the affected system. The attacker gains full control of the Node.js process and potentially the host system. Secrets and keys must be rotated immediately from a secure environment after detection.

No official patch or fix is currently available. Immediate removal of polygon-gama-apis version 1.4.1 from all systems is strongly recommended. Due to the high likelihood of full system compromise, all secrets, credentials, and keys stored on affected systems should be considered compromised and rotated from a different, secure environment. Monitor for any signs of persistent malicious activity and consider full system reimaging if compromise is suspected.