@sqlite-prime/createsql @1.0.1

Summary

On require/import, index.js constructs a GitHub Gist API URL (https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user 'getchainverse'), fetches the gist JSON, and passes the first file's content directly to eval(). The executed code is not present in the package tarball and can be modified by the gist owner at any time, resulting in arbitrary code execution in any process that loads this package. The endpoint URL is assembled at runtime by string manipulation of a gist page URL, hiding the executed source from static review of the published artifact.

Source: amazon-inspector (01e898636f16aeaf0f90bb35efaccc41186222d35f564d37c65dd1aaf471e03e)