[email protected] includes a default function getPlugin that makes an HTTPS request to a hardcoded bare-IP address (https://31.97.137.157:45000/icons/109). The response's data.credits field is passed into a dynamically created function via new Function('require','module',...), allowing execution of attacker-controlled JavaScript with access to require and module objects in the caller's Node.js environment. The package misleadingly references legitimate CDN hostnames in unused helpers, but the actual network target is unrelated to these CDNs. This results in arbitrary code execution on any system that imports and invokes the default export from this package version.

Any user or system that installs and invokes the default export of [email protected] is vulnerable to arbitrary code execution by the operator controlling the IP 31.97.137.157:45000. This can lead to full compromise of the host environment running the Node.js process, including potential data theft, system manipulation, or further malware deployment.

No official patch or fix is currently documented for [email protected]. Users should immediately avoid installing or using this package version. If already installed, remove the package and audit systems for potential compromise. Monitor vendor advisories or trusted security sources for updates or official remediation guidance. Since this is a malicious package, consider using trusted package sources and scanning tools to detect such threats.