@sqlite-prime/nodesql@1.0.4

Analysis

@sqlite-prime/nodesql@1.0.4 is a trojanized clone of the `buffer` package. Its index.js is the standard buffer v5 source with an injected line at the top that dynamically imports the dependency `@sqlite-prime/createsql` at module load time. That dependency is a known-malicious package, so merely requiring this package executes the malicious dependency's payload. The package ships no repository-verifiable content and its declared purpose (a SQL/node package) does not match the buffer code it contains.