velora-kit @12.1.2

Summary

velora-kit@12.0.2 exports a getPlugin() function that fetches content from a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/116 and passes the response's data.credits field to new Function(...) , which is then invoked with require , module , process , Buffer , and Promise injected — executing attacker-controlled JavaScript with full Node.js privileges in the consumer's process. Variable naming (protocol/domain/path split, bearrtoken: 'logo' , token: '116' ) is styled to resemble a CDN icon fetcher while actually constructing a URL to a bare-IP host and evaluating the returned payload as code. The declared dependency set (@primno/dpapi for Windows DPAPI decryption, better-sqlite3/sqlite3 for browser-profile database reads, node-machine-id, socket.io-client, request, axios) provides the fetched second-stage code with capabilities aligned to credential and wallet theft from local browser profiles.

Source: amazon-inspector (a60310ccbaf263dc4333db7ecb716cbf5f5ae13a2cfc9d8b7416f82e4561d7bb)