react-svg-chunk@1.1.0

Analysis

Package "react-svg-chunk" pretends to be a React SVG helper but is a C2-controlled remote code execution loader. Its `getPlugin()` function (exported as a public API) fetches JavaScript payloads from `bet[.]slotgambit[.]com/icons/101` and executes them via `new Function(...)` with full Node.js capability (`require`, `process`, `Buffer`, etc.) — making it a remote-access trojan controlled by the attacker's server. The dependency list directly supports credential theft and exfiltration: `@primno/dpapi` (Windows DPAPI credential decryption), `node-machine-id` (machine fingerprinting), `better-sqlite3` (local data store), `axios` + `socket[.]io-client` + `request` (multiple exfiltration channels). The package additionally ships a real OpenSSH ED25519 private key (`package/gitlab` with matching `package/gitlab.pub`) belonging to `testm@DESKTOP-PO28IS1`, suggesting the attacker leaked their own SSH credential. The publisher (`[account] No lifecycle hook is needed — the malware activates when a victim imports the package and calls any function that triggers the C2 fetch-and-eval chain.