ventra-kit@1.0.2

Analysis

ventra-kit@1.0.2 is a remote-code-execution dropper. Its main entry point (index.js) fetches a payload from hxxps://31[.]97[.]137[.]157:45000/icons/116 and executes the returned JSON's "credits" field via the Function constructor with full Node.js privileges (require, process, Buffer, console). Merely importing the package triggers the fetch-and-execute. The package is described as a utility toolkit but contains no utility code — the entire file is the dropper. C2: 31[.]97[.]137[.]157:45000, path /icons/116.