The poly-bbc-service npm package version 3.7.2 contains malicious code that fetches and executes remote code with full Node.js privileges. The package's getPlugin function makes an HTTPS request to a hardcoded IP address and executes the response's data.credits field as a function, granting extensive system access. The package also includes unused code suggesting a cover story inconsistent with its advertised purpose. Dependencies indicate potential staging for extracting browser credentials or Windows DPAPI-protected secrets.