registry / @sqlite-labs-free/createsql / 1.0.5

@sqlite-labs-free/createsql@1.0.5

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Importing the package downloads and executes attacker-controlled remote JavaScript. This is unguarded runtime remote code execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Requiring or importing the package entrypoint.

Impact

Arbitrary code execution in the consuming process.

Mechanism

Remote script fetch followed by eval().

Attack narrative

The CommonJS entrypoint immediately calls fetchBlobData(), which retrieves script.js from Vercel Blob storage and evaluates the response text. Whoever controls that remote object can execute arbitrary JavaScript whenever a consumer imports the package.

Rationale

The source establishes an immediate remote-payload execution chain; no legitimate package functionality is present to justify it.

Evidence

package.jsonindex.js

Network endpoints1

bdmkaoyijqmqa6bg.public.blob.vercel-storage.com/script.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js fetches a remote script URL.

@sqlite-labs-free/createsql@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code