dbconnectify@1.0.2

Analysis

Trojanized MySQL database connector that contains a remote code execution backdoor. The package exports a DivbloxDatabaseConnector class that appears to be a legitimate database wrapper, but includes a hidden method queryDBConnect() that decodes a base64-embedded URL (hxxps://api[.]jsonbin[.]io/v3/b/6a609e63f5f4af5e29b05907), fetches the 'cookie' field from the JSON response, and compiles/executes it as arbitrary JavaScript via node:module.Module._compile(). The attacker controls the jsonbin[.]io bin and can serve any payload to compromised systems. The backdoor executes when the module is required. The package does not declare axios as a dependency, so the backdoor may fail silently if axios is not already installed.