MAL-2026-13939 Malicious code in @leonardo0902/vortex-kit (npm)

The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned credits field to new Function('require',..., 'Promise', data.credits), executing attacker-controlled JavaScript with full Node context (require, process, Buffer) whenever the module is loaded and its exported function is invoked. The fetch destination is disguised as a static-asset endpoint: the file defines a decoy setDefaultModule referencing legitimate CDNs (cloudflare, fastly, akamai, cloudfront) and a font-awesome path, then reuses the identical variable names (protocol, domain, path, head, bearrtoken: 'logo') around the bare-IP fetch-and-eval to frame it as an icon download. Bundled native dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a dynamically delivered browser-credential-stealer payload. The remote code is unpinned, unverified, and controlled entirely by whoever operates the IP.