@sqlite-node/createsql@1.0.9

Analysis

This package advertises itself as a SQLite toolkit but contains no SQLite functionality. Its main module fetches a hardcoded remote GitHub gist over HTTPS, extracts the contents of the first file in that gist, and passes it directly to eval(), executing attacker-controlled JavaScript whenever the module is loaded. The remotely-hosted payload can be changed by the attacker at any time, making it a remote-code-execution loader/dropper.