MAL-2026-12223

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ae9425c630e8b36b03993f6124066f178a86a285ae44e5e4590016ac575c4cac) index.js exposes getPlugin(), which performs an HTTP GET to http://46.183.25.232:45000/icons/106, parses the JSON response, and passes the `credits` field to `new Function(...)` with `require`, `module`, `process`, and `Buffer` injected — giving the remote endpoint full Node.js execution privileges on the consumer's host. The destination URL is assembled from split string fragments (protocol/separator/domain/path) and framed with icon/CDN-style naming (`iconDomain`, `bearrtoken: 'logo'`, path segment `icons/`), while a separate setDefaultModule function references a benign-looking cdnjs/font-awesome URL as a decoy. The package name typosquats the tailwindcss ecosystem, and declared dependencies include @primno/dpapi, better-sqlite3, and node-machine-id — libraries associated with Windows credential/DPAPI access, browser SQLite database reads, and host fingerprinting. The transport is plain HTTP to a bare IP with no integrity check, so the executed payload is attacker-controlled and mutable.