The CommonJS entry point exports an undocumented getPlugin() factory that fetches a URL-shortener target (https://shorturl.at/nkw3a) and passes a JSON field from the response to eval, executing attacker-controlled JavaScript inside the caller's Node.js process. The shortener destination is mutable, so the operator can swap the executed payload at any time without republishing the package. Additional concealment signals: the function uses cover-story field names (bearrtoken: 'logo', parsed.cookie guarding eval(parsed.model)); the backdoor exists only in the CommonJS build (the ESM entry omits it); the file requires an undeclared request dependency; and the README advertises 'zero dependencies' and does not mention this behavior. Any consumer invoking getPlugin()() via the CJS build will execute remote code chosen by whoever controls the shortener.