@vertexa/prisma-engines@7.8.1

Analysis

@vertexa/prisma-engines is a combosquat of Prisma's @prisma/engines package. Its postinstall hook downloads the "Prisma engine" binary from an attacker-controlled GitHub fork (github[.]com/lh0x00/prisma/releases/download/engines-b436f5b358bf3b9d72861631111333dd40434f73) instead of the official Prisma binaries host, and executes the downloaded binary at install time. The attacker controls the binary that is fetched and run on every install.