The poly-bbc-service npm package version 3.7.2 exports a getPlugin function that performs an HTTPS request to a hardcoded IP endpoint (https://46.183.25.232:45000/icons/107). It then executes the data.credits field from the response as a new Function with access to require, module, exports, process, and Buffer, effectively granting the remote payload full Node.js privileges on the host machine. The package contains unused helper code that constructs plausible CDN URLs unrelated to the actual runtime behavior, suggesting an attempt to mislead users about its true function. Declared runtime dependencies such as @primno/dpapi, better-sqlite3, and node-machine-id align with capabilities for extracting browser credentials or DPAPI-protected secrets, indicating malicious intent.

If executed, the malicious code can run arbitrary commands with full Node.js privileges on the consumer's machine, potentially leading to credential theft, secret extraction, and full system compromise. The presence of dependencies related to Windows DPAPI and machine identification further suggests targeted credential harvesting capabilities.

No official patch or remediation is currently documented for this malicious package version. Users should immediately cease using poly-bbc-service version 3.7.2 and remove it from their environments. Verify dependencies and audit installed packages for this malicious version. Consider using trusted package sources and tools that detect malicious npm packages. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.