sql-limit-enforcer@10.0.0: Malicious npm security report (Block)

OSV Malicious Advisory

imported 24d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16151 confirms this npm version as malicious. Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the...

Advisory

MAL-2026-16151

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in sql-limit-enforcer (npm)

Details

Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.

Decision reason

OpenSSF Malicious Packages via OSV confirms sql-limit-enforcer@10.0.0 as malicious (MAL-2026-16151): Malicious code in sql-limit-enforcer (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

sql-limit-enforcer@10.0.0

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code