@sqlite-group/schema-generator@1.0.2

Analysis

@sqlite-group/schema-generator@1.0.2 is a combosquat package that acts as a remote-code-execution dropper. When imported (require), index.js fetches a GitHub Gist (b57a92378ad0a52430137c3b810e7107) via api[.]github[.]com and executes the gist content with eval(). The gist is controlled by the same publisher (getchainverse[.]com domain), allowing the attacker to serve arbitrary malicious code at any time. The package has no lifecycle hooks and no legitimate SQL functionality despite its name and description.