vexium-kit@2.0.2

Analysis

vexium-kit@2.0.2 executes remote code at require-time. The package's main entry (index.js) exports a function that, when the module is required, fetches hxxps://31[.]97[.]137[.]157:45000/icons/116 and executes the returned JSON's "credits" field via the Function constructor with a full Node.js context (require, process, Buffer, module, timers). This gives the remote server arbitrary code execution inside the installer's environment. The package is presented as a lightweight utility toolkit but ships heavy unrelated dependencies (better-sqlite3, sqlite3, express, socket[.]io-client, axios, request). C2: 31[.]97[.]137[.]157:45000, path /icons/116.