ts-utility-plus@1.3.2

Analysis

ts-utility-plus@1.3.2 is a remote-code-execution dropper. Its main entry point (index.js) fetches a payload from hxxps://31[.]97[.]137[.]157:45000/icons/109 (HTTP header bearrtoken:logo) and executes the response body via the Function constructor with a full Node.js context exposed (require, process, Buffer, global, setTimeout), so the remotely-served code runs with full access to the host. The package is described as a TypeScript utility toolkit but contains no utilities — the entire module is a fetch-and-exec dropper with a retry loop. The C2-served stage is not shipped in the tarball, so its behaviour is determined by the remote server.