font-huge@2.5.3

Analysis

font-huge@2.5.3 is a trojanized package that poses as a font library but functions as a remote code execution downloader. When imported, the exported getPlugin() function fetches a JSON payload from hxxps://svganchordev[.]net/icons/107 and executes the 'credits' field of the response via new Function() with full Node.js globals (require, process, Buffer, console, setTimeout, Promise). The package bundles dependencies for credential theft (@primno/dpapi for Windows DPAPI extraction), system fingerprinting (node-machine-id), C2 communication (socket[.]io-client), and local database access (sqlite3, better-sqlite3). The README describes a font collection API that does not exist in the code.