@sqlite-tag/schema-generator@1.0.2

Analysis

The package index.js fetches a remote payload from a GitHub Gist (gist[.]github[.]com/getchainverse/b57a92378ad0a52430137c3b810e7107.js) via the GitHub API and executes it with eval(), giving the attacker full control over what code runs in the installer's environment. The package has no lifecycle hooks — the fetch+eval runs on require(). The package description and repository URL are unrelated to this behaviour.