external-process-live-log@13.5.2

Analysis

The package's main module exports a function that, when called, fetches a payload from hxxp://31[.]97[.]137[.]157:45000/icons/107 (with header bearrtoken: logo) and executes the response body's "credits" field as JavaScript via the Function constructor, with require, process, Buffer, and timers injected into the execution context. This gives the remote server full code execution inside the importing process, including filesystem, network, and child-process access. The package's stated purpose (a Polymarket SDK / process-logging helper) does not match this behaviour.