The @ica-gaming/slot-engine npm package (version 1.1.0) masquerades as a deterministic WASM slot-math engine but embeds obfuscated Node.js modules and Emscripten JavaScript shims that implement a remote-access and credential-theft toolkit. On invocation, it opens a Node.js require context, sends an installer ID to a remote HTTPS endpoint on a jittered polling loop, and executes returned code dynamically, allowing arbitrary code execution on the host. Additional helpers download and silently install Windows and macOS payloads, create polyglot wrapper scripts, and enumerate browser profiles (Chrome, Firefox, and derivatives) and wallet/keystore files to steal credentials and sensitive data. The payload uses obfuscation techniques uncommon in legitimate Emscripten output and includes cover strings to disguise malicious activity as normal initialization.

This malicious package enables an attacker to gain arbitrary code execution on the host system, persistently execute remote code, silently install additional malware payloads on Windows and macOS, and steal sensitive credentials and data from multiple browser profiles and cryptocurrency wallets. This can lead to full system compromise, data theft, and further malware deployment.

No official patch or remediation is currently available for this malicious package. Users should immediately remove version 1.1.0 of @ica-gaming/slot-engine from their environments and avoid installing this package. Conduct a thorough investigation for potential compromise if this package was used, including scanning for additional malware and credential theft. Monitor for suspicious network activity related to the described remote code execution behavior. Check vendor advisories or trusted security sources for updates or remediation guidance.