config-helper-kit@1.3.2

Analysis

config-helper-kit's main entry point (index.js) is a remote-code-execution dropper. On load it fetches hxxps://31[.]97[.]137[.]157:45000/icons/109 (with a custom HTTP header bearrtoken:"logo"), reads the JSON response's "credits" field, and executes that string as JavaScript via the Function constructor with full Node.js access (require, process, Buffer, module, exports). The actual malicious payload is served remotely from the IP 31[.]97[.]137[.]157:45000 rather than shipped in the package, so it can be changed at any time and runs arbitrary code on the installer's machine.