ventrix-kit@1.5.2

Analysis

ventrix-kit@1.5.2 is a trojanized utility library that functions as a remote code execution downloader. On require(), it fetches arbitrary JavaScript from a hardcoded C2 server at 31[.]97[.]137[.]157:45000/icons/116 (with custom header bearrtoken:logo) and executes the response via the Function constructor with full Node.js access (require, process, Buffer). The package ships dependencies for credential theft: @primno/dpapi (Windows DPAPI credential decryption), node-machine-id (machine fingerprinting), better-sqlite3/sqlite3 (browser database access), and socket[.]io-client (C2 channel). The README falsely advertises "zero dependencies" and a benign utility purpose.