polygon-gama-apis@1.4.1

Analysis

polygon-gama-apis@1.4.1 is a combosquat package that functions as a remote code execution dropper. Its index.js exports a getPlugin() function that fetches a payload from hxxps://bet[.]slotgambit[.]com/icons/111 and executes the response's "credits" field via new Function() with full Node.js runtime access (require, process, Buffer, console, setTimeout). The C2 host is bet[.]slotgambit[.]com, path /icons/. The package has no lifecycle hooks but the dropper activates when getPlugin() is called. The README is a copy-paste describing a different package and references a non-existent GitHub repository.