webpack-cdn-fetcher@1.0.1

Analysis

webpack-cdn-fetcher@1.0.1 is a trojanized package that performs remote code execution when imported. The exported function fetches a second-stage payload from bet[.]slotgambit[.]com/icons/110 and executes the response's 'credits' field as arbitrary JavaScript via new Function() with full Node.js API access (including require, process, Buffer, child_process). It bundles dependencies for credential theft and exfiltration: @primno/dpapi (Windows DPAPI credential decryption), better-sqlite3 and sqlite3 (local database extraction), node-machine-id (system fingerprinting), socket[.]io-client (realtime C2 channel), and express/axios/request (HTTP exfiltration). IOC: bet[.]slotgambit[.]com.