ambera @1.0.1

Summary

The package presents itself as a zero-dependency SVG helper, but its exported getPlugin() function performs an HTTPS GET to the hardcoded host https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body directly to new Function('require', data)(require). Any caller of getPlugin() executes whatever JavaScript the remote host returns, with the Node require function injected — effectively arbitrary remote code execution on the caller's machine. The destination host api.avax-test.dev is a lookalike of the legitimate Avalanche Fuji RPC endpoint api.avax-test.network, and the Avalanche/Snowtrace variable naming is cover-story labeling: the package's stated SVG purpose has no network or blockchain functionality. Combined with the disabled TLS verification, this is a deliberately concealed remote-exec channel embedded in an unrelated utility.

Source: amazon-inspector (d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625)