The svgcraft-core package's CommonJS build (versions 1.0.1 to 1.0.6) exports a getPlugin() function that fetches JavaScript code from a typosquatted domain 'api.avax-test.dev' with TLS verification disabled (rejectUnauthorized: false). The fetched code is executed dynamically with access to Node.js require(), allowing arbitrary code execution in the host process. The ESM build does not contain this malicious behavior, indicating intentional insertion to evade detection. This is a supply-chain compromise distributing attacker-controlled code through the npm package.

Any application that installs and invokes getPlugin() from the affected svgcraft-core CommonJS versions will execute attacker-controlled code with full access to the Node.js environment, potentially leading to complete system compromise. The use of a typosquatted domain and disabled TLS verification increases the risk of unnoticed exploitation. This threat enables remote code execution within the context of the affected application.

No official patch or remediation is currently documented. Users should immediately avoid using svgcraft-core versions 1.0.1 through 1.0.6, especially the CommonJS build. Consider auditing dependencies for this package and remove or replace it with a trusted alternative. Monitor vendor advisories for any forthcoming official fixes or updates. Until a fix is available, do not invoke getPlugin() from this package.