async-mutex-lock @5.3.1

Summary

The package is advertised as a mutex-lock utility but ships none of the documented API (no Mutex/lock/unlock). Its sole export, getPlugin in index.js, assembles a URL from split protocol/domain/path variables resolving to https://31.97.137.157:45000/icons/108, fetches a JSON response, and passes the response field data.credits to new Function(...) invoked with full require/process/Buffer context — executing attacker-controlled JavaScript on the caller's host. Variable framing references CDN names (cloudflare, fastly, akamai, cdnjs/font-awesome) as a decoy over a bare-IP destination unrelated to any CDN. Declared dependencies (@primno/dpapi, node-machine-id, better-sqlite3, socket.io-client) are consistent with infostealer staging (DPAPI decryption, machine fingerprinting, SQLite reads of browser stores, socket-based C2). The name resembles the popular async-mutex package.

Source: amazon-inspector (e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e)