Malicious code in async-mutex-v2 (npm)

__

Source: amazon-inspector (7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5)

Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry (index.js) exports getPlugin(), which performs an HTTPS request to https://svganchordev.net/icons/108 and passes the response field data.credits into new Function('require','module',...,'Promise', data.credits), executing attacker-supplied JavaScript with full Node capabilities (require, process, Buffer, etc.) on the caller's host. A separate setDefaultModule routine referencing font-awesome/cdnjs strings acts as a decoy consistent with the icon-themed exfil host. Declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are not used by any shipped code and are the standard toolkit for Windows DPAPI decryption, Chromium 'Login Data'/'Cookies' SQLite extraction, and host fingerprinting — capabilities that only make sense when invoked by the remotely-fetched payload. The package name, description ('Promise-based mutex'), and keywords (react, helper, svg) do not match the shipped code or dependencies, indicating a lookalike/cover-story around async-mutex.