@sqlite-labs/nodesql @1.0.7

Summary

@sqlite-labs/nodesql@1.0.5 ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins = require('@sqlite-labs/createsql'); . The imported binding ins is never referenced anywhere else in the module; its sole effect is to trigger execution of the sibling package @sqlite-labs/createsql whenever a consumer performs require('@sqlite-labs/nodesql') or import s it. Package metadata reinforces the lure shape: description is empty, keywords are the generic node / sql , homepage points at github.com/guilderguzman/sql-link , and the README is titled bare-stream and instructs the reader to npm i @sql-access/nods — a different scope and name than the published package. The scope @sqlite-labs resembles established SQLite-ecosystem names but is not affiliated with them. Installing and importing this package causes attacker-controlled code in @sqlite-labs/createsql to run in the consumer's process at load time; no lifecycle hook is required.

Source: amazon-inspector (77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef)