If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (3f023d55f53d30a92c8f06ca661862ee99d338f6d3719247c9390b3169009702)
The package's default export (module.exports = () => getPlugin()) issues an HTTPS request to a hardcoded bare-IP host at 31.97.137.157:45000/icons/116 and passes the response's `credits` field into `new Function('require','module','exports',...,'Promise', data.credits)`, executing attacker-controlled JavaScript with full Node.js capabilities (require, process, Buffer, globals). The destination URL is assembled from split protocol/separator/domain/path constants, and an unused `iconDomain` map (cloudflare/fastly/akamai) plus a `setDefaultModule` helper referencing cdnjs/font-awesome provide cover-story framing that disguises the loader as an icon CDN helper. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a Windows browser-credential stealer to be delivered as the remote payload. Any consumer that requires ventra-kit and invokes the default export receives remote code execution on the installer's machine.