@sqlite-labs-free/createsql@1.0.5

Analysis

On require, the package fetches a remote JavaScript payload from hxxps://bdmkaoyijqmqa6bg[.]public[.]blob[.]vercel-storage[.]com/script[.]js and executes it with eval(). The fetched script is attacker-controlled and served from Vercel blob storage; the package itself contains no other code or functionality. Any code in the remote payload runs with the privileges of the importing process.