🛡️ MAL-2026-6914 — nodesql

Malicious code in @sqlite-access/nodesql (npm)

Source: amazon-inspector

The package presents a three-way identity mismatch: the scoped name @sqlite-access/nodesql implies a SQL-access library, the README markets a 'bare-stream' streaming utility, and the shipped index.js is a verbatim copy of the feross/buffer polyfill. Injected at the top of that otherwise-unmodified source is a single line, var ins = import('@sqlite-access/createsql');, which performs a fire-and-forget dynamic import of an unrelated lookalike scoped package. On require()/import of @sqlite-access/nodesql, that co-package's module top-level executes in the installer's process. The visible code is a decoy — the payload lives in the transitively loaded @sqlite-access/createsql module, and the wrapper's only functional effect is to pull that code into the consumer's runtime. The identity mismatch (name vs. README vs. code), the empty description, generic author metadata, and the injected dynamic import together constitute a wrapper/dropper pattern designed to smuggle attacker-controlled code into installer graphs via a plausible-looking utility dependency.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.