The npm package polygon-gama-apis version 1.4.1 contains malicious code that executes arbitrary JavaScript fetched from a remote server. This remote code execution occurs when the package's exported getPlugin() function invokes JavaScript delivered in a disguised field, granting full control to the attacker. The package metadata is deceptive, aiming to lure installs from multiple ecosystems. The package includes dependencies consistent with credential and wallet-stealing malware. Any system with this package installed should be considered fully compromised.