@sqlite-table/schema-generator@1.0.2

Analysis

On require(), index.js fetches a remote payload from hxxps://api[.]github[.]com/gists/b57a92378ad0a52430137c3b810e7107 (a GitHub gist under the account "getchainverse") and executes it via eval(). At runtime the payload attempted DNS resolution to a C2 endpoint. The package has no lifecycle hooks — the malicious code runs when the module is imported, not at install time.