registry / db-convertor / 1.0.5

db-convertor@1.0.5

A database connector class that simplifies connections and queries to a database for nodejs apps

AI Security Review

scanned 21d ago · by lpm-firewall-ai

The package exposes a hidden method that retrieves code from jsonkeeper.com and executes it in a detached Node child process. It is not triggered at install/import time but is reachable through the exported class.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime call to DivbloxDatabaseConnector.queryDBConnect()

Impact

Arbitrary remote code execution in the consumer environment if the method is invoked.

Mechanism

fetch remote payload and execute via detached node stdin

Attack narrative

A consumer importing the package receives a mostly normal MySQL connector class. The hidden queryDBConnect() method fetches a remote session payload from a base64-obscured jsonkeeper.com URL, starts a detached node process, writes the fetched payload to stdin, and unreferences it. This gives the endpoint operator arbitrary code execution when the method is called.

Rationale

Static source inspection confirms a concealed, package-misaligned remote code execution path in index.js. Absence of lifecycle execution lowers trigger breadth but does not make the exposed behavior benign.

Evidence

package.jsonindex.jsREADME.mdtest.js

Network endpoints1

jsonkeeper.com/b/SH5ZW

OSV Corroboration

index.js defines a method `queryDBConnect` on the exported `DivbloxDatabaseConnector` class that base64-decodes a hardcoded constant `HASH_KEY` to the URL https://jsonkeeper.com/b/SH5ZW, fetches the `session` field from that JSON paste via axios, and pipes the returned content as stdin into a detached `node` child process. The fetched bytes are executed without inspection, hashing, signing, or origin checks. jsonkeeper.com is an anonymous mutable paste host — the operator can swap the payload at any time, so any caller who reaches this method runs arbitrary attacker-controlled code in the installer's Node process. The endpoint is obscured behind a base64 literal and `atob()` to evade casual review and string scanners, and the method is undocumented in the README and unrelated to the package's stated database-connection purpose. The package name (`db-convertor`) and keywords (`divblox`, `dx-db-connector`) impersonate the legitimate Divblox `dx-db-connector` package, increasing the likelihood that an installer who mistypes the dependency ends up with this backdoored class. ## Source: ghsa-malware (325a83367699f226bf706d6847891a07256202cb73998bc9866eb485132d2a2a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

db-convertor@1.0.5

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code