MAL-2026-10578

Dashboard / Malicious Package / MAL-2026-10578

MAL-2026-10578

Summary: Malicious code in @sqlite-group/sql-creator (npm)

Details: Source: amazon-inspector (4d3bd76c01604d26251c1650c71f8a99ad32c5389c4e42795477ae660be33a2a) The package is published under a scope that impersonates SQLite (`@sqlite-group`) and declares itself as "cloud definitions for node", but the shipped `index.js` is a near-verbatim copy of the feross/buffer library with a single injected top-level statement: `var ins = import('@sqlite-group/schema-generator');`. This dynamic import fires on any `require`/`import` of the package, handing control to whatever top-level module code the sibling `@sqlite-group/schema-generator` ships. The cover-story mismatch (scope name suggesting SQLite tooling + description claiming cloud definitions + actual code being a Buffer polyfill + one injected loader line) is consistent with a dependency-confusion / namespace-piggyback loader stub whose sole purpose is to pull an attacker-controlled sibling into the installer's process on load. Installer harm is the code execution surface exposed by the sibling dependency, delivered transitively when this package is required. Source: ghsa-malware (f3e579a4512657fc706009a1d42288324dd5a9f02062bfaea96d716670adcc39) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References: https://github.com/advisories/GHSA-pgxx-98xj-2gvg, https://www.npmjs.com/package/@sqlite-group/sql-creator/v/1.0.7