process-live-log@11.5.2

Analysis

process-live-log is a remote-code-execution dropper disguised as a log-reading utility. Its main entry point (index.js) fetches a payload from hxxps://31[.]97[.]137[.]157:45000/icons/107 (raw IP, non-standard port, custom request header "bearrtoken: logo"), reads the "credits" field of the JSON response, and executes it as arbitrary JavaScript via the Function constructor with full Node.js privileges (require, process, Buffer, module, timers). The remote payload is fetched and executed at runtime, so the package runs whatever code the C2 server returns, with retries. The package's stated purpose (live process log reader / Polymarket SDK) does not match this behaviour.