route-processor@3.1.5

Analysis

route-processor@3.1.5 is a trojanized package that claims to be a React SVG helper but contains a remote code execution payload. When imported, the getPlugin function fetches a payload from hxxps://svganchordev[.]net/icons/107 (with custom header bearrtoken: "logo") and executes the response via new Function() with full access to Node.js built-ins (require, process, Buffer, child_process, etc.), enabling arbitrary code execution on the host. The package has no repository and its dependencies (axios, better-sqlite3, express, socket[.]io-client, sqlite3) are unrelated to its stated purpose.