@sqlite-labs/nodesql@1.0.5

Analysis

@sqlite-labs/nodesql is a trojanized clone of the npm `buffer` module. The package's index.js is the verbatim buffer source with an injected `require('@sqlite-labs/createsql')` at the top. That dependency's index.js fetches a remote script from hxxps://bdmkaoyijqmqa6bg[.]public[.]blob[.]vercel-storage[.]com/script[.]js and executes it with eval() at require time, giving the remote script arbitrary code execution in the installer's process.