fastify-client-bundler@1.4.0

Analysis

Combosquat package impersonating a Fastify client bundler (the README describes a different package, "Tailwindcss Forms Bundler"). The exported getPlugin() function fetches a remote payload from a hardcoded IP address (31[.]97[.]137[.]157:45000) at path /icons/105 and executes it via new Function() with full Node.js context including require, process, and Buffer, enabling arbitrary remote code execution. The payload is served from the remote server at time of use, not shipped in the package itself. The C2 host is 31[.]97[.]137[.]157 on port 45000.