@sqlite-prime/nodesql @1.0.6

Summary

@sqlite-prime/nodesql@1.0.6 ships a verbatim copy of the well-known buffer library as its main entry ( index.js ) with a single injected top-level statement var ins = import('@sqlite-prime/createsql'); that dynamically loads the sibling scoped package @sqlite-prime/createsql (declared as a dependency, ^1.0.1 ) whenever a consumer require() s this module. The sibling package's code is not shipped in this tarball, is unpinned, and is unrelated to the advertised buffer polyfill functionality. Package identity is inconsistent across metadata: package.json names the package @sqlite-prime/nodesql , the README titles the project bare-stream and instructs npm i @sql-access/nods , the LICENSE header is copied from the type-is project (Jonathan Ong / Douglas Christopher Wilson), and the code is copied from Feross Aboukhadijeh's buffer . This is the canonical loader/staging shape: a benign-looking copy of a popular library with an injected import that pulls in and executes an external, unrelated package at load time.

Source: amazon-inspector (cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617)