db-convertor@1.0.5

Analysis

Package masquerades as a MySQL database connector but contains a hidden queryDBConnect() method that decodes a base64-embedded URL (hxxps://jsonkeeper[.]com/b/SH5ZW), fetches a remote payload over HTTPS, spawns a detached Node.js process with stdin piped, and writes the fetched payload into the child process's stdin for remote code evaluation. The child process is spawned with detached:true and unref() to outlive the parent. The payload delivery URL is jsonkeeper[.]com/b/SH5ZW.