font-hub@1.5.2

Analysis

The package index.js fetches JSON from hxxps://svganchordev[.]net/icons/107 and passes the response's 'credits' field to a new Function() constructor with full Node.js context (require, process, Buffer, setTimeout, etc.), enabling arbitrary remote code execution. The fetched payload runs with access to all Node.js APIs. The package also ships dependencies including node-machine-id (host fingerprinting), socket[.]io-client (real-time C2 channel), @primno/dpapi (Windows credential access), and sqlite3/better-sqlite3 (local database access) — tooling for the remotely-delivered payload. The README is a copy-paste from the unrelated polymarket-clob-api package, confirming the package is misrepresented.