vectormark@1.0.0

Analysis

vectormark@1.0.0 is a trojanized SVG helper that exports a hidden getPlugin() function. When called, getPlugin() reads the AVALANCHE_FUJI_RPC_URL and SNOWTRACE_API_KEY environment variables, performs an HTTPS GET to the RPC URL (default: hxxps://api[.]avax-test[.]dev/ext/bc/C/rpc) with TLS verification disabled, and passes the response body to new Function('require', data.toString())(require) — executing arbitrary remote code with full access to Node.js require(). The package's README describes only benign SVG parsing functions and does not document getPlugin(). The RPC URL is attacker-controlled via the AVALANCHE_FUJI_RPC_URL environment variable, making the response body a fully attacker-controlled payload.