ventra-kit @1.0.2

Summary

The package's default export (module.exports = () => getPlugin()) issues an HTTPS request to a hardcoded bare-IP host at 31.97.137.157:45000/icons/116 and passes the response's credits field into new Function('require','module','exports',...,'Promise', data.credits) , executing attacker-controlled JavaScript with full Node.js capabilities (require, process, Buffer, globals). The destination URL is assembled from split protocol/separator/domain/path constants, and an unused iconDomain map (cloudflare/fastly/akamai) plus a setDefaultModule helper referencing cdnjs/font-awesome provide cover-story framing that disguises the loader as an icon CDN helper. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a Windows browser-credential stealer to be delivered as the remote payload. Any consumer that requires ventra-kit and invokes the default export receives remote code execution on the installer's machine.

Source: amazon-inspector (3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702)