취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f)

index.js exports getPlugin(), which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field data.credits to new Function(require, module, exports,..., Promise, data.credits), executing attacker-controlled JavaScript with full Node privileges (require, process, Buffer, globals available to the injected function). A sibling export setDefaultModule() constructs a benign-looking cdnjs font-awesome URL that matches the README's advertised SVG-fetching purpose but is never used by getPlugin(), serving as a cover story for the remote loader. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with Windows DPAPI credential/browser-database access that a downloaded payload could invoke. The tarball also ships an unencrypted ed25519 OpenSSH private key (file 'gitlab' with comment testm@DESKTOP-PO28IS1) and its matching public key; the key is not read by the loader and represents an author-side exposure rather than an installer-side attack path.