registry / @sqlite-table/schema-generator / 1.0.2

@sqlite-table/schema-generator@1.0.2

simple node for sql fetch

AI Security Review

scanned 18d ago · by lpm-firewall-ai

Importing the package triggers a remote fetch and executes remote-controlled JavaScript. The payload can be changed independently of the published package.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Requiring or importing the main entrypoint (index.js).

Impact

Arbitrary code execution in the consuming process.

Mechanism

Remote Gist fetch followed by eval of returned content.

Attack narrative

At module import, index.js derives a Gist ID, fetches its GitHub API representation, takes the first returned file's content, and passes it to eval. A party able to alter that Gist, or a compromised remote source, can execute arbitrary JavaScript in every consumer process without republishing the npm package.

Rationale

Source inspection confirms an import-time remote-payload loader with dynamic execution. This is a concrete arbitrary-code-execution chain, not merely a static hint.

Evidence

package.jsonindex.js

Network endpoints2

api.github.com/gists/b57a92378ad0a52430137c3b810e7107gist.github.com/getchainverse/b57a92378ad0a52430137c3b810e7107.js

Decision evidence

public snapshot

@sqlite-table/schema-generator@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code