@sqlite-labs/createsql @1.0.5

Summary

The package's main entry (index.js) fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket (https://bdmkaoyijqmqa6bg.public.blob.vercel-storage.com/script.js) and passes the response body directly to eval() as an unconditional top-level side effect. Any consumer that require()s or imports this package downloads and executes attacker-controlled JavaScript in the installer's Node process, with no pinning, no integrity verification, and no relation to the SQL/database purpose implied by the package name. The remote URL is stored in a variable named gisturl while actually resolving to a mutable Vercel blob endpoint — a cover-story naming pattern consistent with a dropper rather than legitimate remote configuration.

Source: amazon-inspector (375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75)