Malicious code in @leonardo0902/vortex-kit (npm)

The npm package @leonardo0902/vortex-kit@12.0.2 contains malicious code that executes remote code whenever the module is loaded or its exported function is invoked. The package makes an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned credits field to new Function(), executing attacker-controlled JavaScript with full Node.js context access (require, process, Buffer).\n\nThe malicious fetch is obfuscated by defining a decoy setDefaultModule function that references legitimate CDNs (Cloudflare, Fastly, Akamai, CloudFront) and font-awesome paths, then reuses identical variable names around the actual bare-IP fetch-and-eval to frame it as a static asset download.\n\nThe package bundles native dependencies (@primno/dpapi, better-sqlite3, node-machine-id) consistent with a browser-credential-stealer payload. The remote code is unpinned, unverified, and entirely controlled by the operator of the IP address.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages repository.