@ai-agent-node/createnode @1.0.1

Summary

@ai-agent-node/createnode ships a ~12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 (owner: getchainverse) and passes the first file's content directly to eval(). The package has empty author/description metadata and no other functionality; its entire behavior is loading and executing attacker-mutable third-party Gist content. Any consumer that imports this package executes arbitrary JavaScript pulled from a Gist under an unrelated account, and that content can be swapped by its owner at any time.

Source: amazon-inspector (88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4)