MAL-2026-4561 Malicious code in fe-utils-core (npm)

The package's default-exported getPlugin function fetches https://svganchordev.net/icons/110 and passes the response's data.credits field to new Function() with require, process, Buffer, module, exports, and Promise injected — executing arbitrary attacker-controlled JavaScript with full Node privileges whenever a caller invokes the documented API. The endpoint is hardcoded to a domain unrelated to the package's stated purpose and is not referenced in README. Errors are swallowed and the request silently retried, which is consistent with covert C2 behavior. The declared dependency set (@primno/dpapi for Windows DPAPI decryption, node-machine-id, better-sqlite3 and sqlite3 for browser/credential database access, socket.io-client for persistent C2, axios/express/request) is unused by the small advertised utility surface (~30 lines of debounce/throttle/isEmpty helpers in src/utils.js) but is pre-positioned in node_modules so a remote-fetched payload can require() these capabilities without a second fetch. The combination — remote-fetch-and-eval plus a credential-harvesting toolkit pre-installed as dependencies — leaves no benign interpretation.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.