If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87)
index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch (variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo'), retrieves a JSON response, and passes the response's `credits` field into `new Function('require','module',...,data.credits)` invoked with full Node capabilities (require, module, process, Buffer, globals). Any consumer that loads the package and invokes the default export executes arbitrary attacker-controlled JavaScript delivered from that endpoint. The cover-story naming (unused setDefaultModule referencing cdnjs/cloudflare decoy domains) conflicts with the README's benign trading-library description. The declared dependencies (node-machine-id, @primno/dpapi, better-sqlite3) are consistent with wallet and browser-cookie stealer tooling and provide primitives the remotely fetched code can leverage.