Malicious code in process-live-log (npm)

The npm package process-live-log was found to contain malicious code in its default export function getPlugin. When invoked, this function issues an HTTPS request to a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/107) and passes the returned data's credits field to new Function(...) with Node.js globals (require, process, Buffer, etc.) injected, then executes it.\n\nThe package exhibits multiple indicators of compromise: the README describes a live-log utility while package.json advertises a 'TypeScript SDK for the Polymarket CLOB API', and keywords include unrelated terms like 'react', 'helper', 'svg'. A dead setDefaultModule function constructs plausible CDN URLs but is never called; the reachable code path targets the bare IP instead.\n\nDeclared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with browser-credential-stealer post-exploitation tooling that the fetched payload could invoke. Any consumer that imports and calls the default export executes attacker-controlled JavaScript with full Node.js privileges.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.