vectormark @1.0.1

Summary

vectormark@1.0.0 advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin() that issues an HTTPS GET to the hardcoded lookalike domain api.avax-test.dev (the legitimate Avalanche Fuji testnet host is api.avax-test.network) with TLS certificate verification disabled (rejectUnauthorized: false), then passes the raw response body into new Function('require', data)(require). Any caller that invokes getPlugin() — or any tool that auto-enumerates the package's exports — executes attacker-controlled JavaScript with full require access on the host. The endpoint variable is named AVALANCHE_FUJI_RPC_URL and the sink is named getPlugin to blend with legitimate blockchain tooling; the README does not mention this function, and package.json omits the 'request' dependency the file otherwise references. The lookalike domain, disabled TLS verification, cover-story naming, and mismatch between the advertised SVG-helper purpose and the actual code path establish intent.

Source: amazon-inspector (6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e)