cors-version@1.0.3

Analysis

cors-version is a combosquat of the popular cors package. The package ships a trojanized SVG utility library (described as "svgcraft-core") with a remote-code-execution dropper in src/index.cjs. The getPlugin() function makes an HTTPS GET request to api[.]avax-test[.]dev/ext/bc/rpc (with TLS verification disabled), then passes the response body to new Function('require', data.toString())(require), executing arbitrary remote code with full Node.js require access. The package has no lifecycle hooks — the payload executes when the getPlugin() function is called by any code that imports the package. The package name cors-version is unrelated to its described SVG-utility purpose.