Malicious code in ambera (npm)

The ambera package, presented as a zero-dependency SVG helper, includes a getPlugin() function that performs an HTTPS GET request to a hardcoded remote host (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (rejectUnauthorized: false). The response body is passed directly to new Function('require', data)(require), causing any JavaScript returned by the remote host to be executed with access to Node's require function. This creates a concealed remote code execution channel unrelated to the package's stated purpose. The remote host is a lookalike of the legitimate Avalanche Fuji RPC endpoint, and the Avalanche/Snowtrace naming is a cover story. This behavior affects ambera versions 1.0.0 and 1.0.1.

Any user invoking the getPlugin() function in affected ambera versions risks arbitrary remote code execution on their system, as the package executes JavaScript fetched from a malicious remote server with disabled TLS verification. This can lead to full compromise of the environment running the package.

No official patch or remediation is currently documented. Users should immediately cease using ambera versions 1.0.0 and 1.0.1. Avoid calling the getPlugin() function or any functionality from this package. Monitor for updates from the package maintainer or npm registry for any official fixes or removals. Until then, consider removing the package from projects and replacing it with trusted alternatives.