db-connector-log@1.0.0

Analysis

This package masquerades as a database connector (a renamed copy of a legitimate divblox DB-connector library) but injects a hidden remote-code-execution stager into index.js. A base64-encoded string conceals the URL hxxps://jsonkeeper[.]com/b/L435A; the added queryDBConnect() method decodes it, fetches a JSON document, and extracts a session field containing attacker-controlled JavaScript. It then spawns a detached node interpreter with a piped stdin, writes the fetched code into that interpreter, and unrefs/detaches the process so it runs in the background independent of the parent. The result is execution of arbitrary remote-controlled code on any host that imports the package and calls the connector, with no further indication to the user.