{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "7e8b618753db019263d7d472f0ca2a1561c428cc7dae515032d9677bb5d4d892",
              "tlsh": "d672300637f72527017b7068a6cb5080a439f41b2b35d860be5cc6715fa87b8bda37d8"
            },
            {
              "path": "package.json",
              "sha256": "a3b56e8adb7dfc3d892216b7d548536f6c19e2917c23b1757ac95b1c69d4c8d5",
              "tlsh": "32016835c9201ca316ab36984c555105b12190ebcf08ed4477cc116ccf6e29b22ae3ae"
            }
          ],
          "package_integrity": [
            {
              "filename": "db-dx-connector-1.0.0.tgz",
              "hashes": {
                "sha1": "4621c8f4e81dda030638bbdd54dbca0407770454",
                "sha512_sri": "sha512-xxK01exWEJD1dj5iX/S23WoZ/RT1QH4y+6yDysyyrsXn0tZg3ut2RK5vHZtS1cgnImaHWYiMJXeEUSOZGLBnJg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "db-dx-connector"
      },
      "versions": [
        "1.0.0",
        "1.0.1",
        "1.0.2"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-005190",
        "import_time": "2026-06-09T20:45:50.787271159Z",
        "modified_time": "2026-06-09T20:18:26Z",
        "sha256": "6eeeef7d309b24e00c0e45df8736d1d8b8d279207d2bfa766c75890815e5382d",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-006858",
        "import_time": "2026-06-16T23:03:44.318776268Z",
        "modified_time": "2026-06-16T22:47:12Z",
        "sha256": "b0a6cd3a84c38e801823eba4ccf0d4ff2a28f5955309bfb300f7f0f640b1a69b",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-007023",
        "import_time": "2026-06-18T19:20:02.780433786Z",
        "modified_time": "2026-06-18T19:08:47Z",
        "sha256": "ee8717a253384a26fdaea14cf33003127a3ab77c8ec5cc28e93f73ba79d3e0f9",
        "source": "amazon-inspector",
        "versions": [
          "1.0.2"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b0a6cd3a84c38e801823eba4ccf0d4ff2a28f5955309bfb300f7f0f640b1a69b)\ndb-dx-connector is a name-transposition of the legitimate divblox package dx-db-connector (the package.json even points repository.url at github.com/divbloxjs/dx-db-connector, which it does not own). Beyond mimicking the real connector\u0027s API, index.js (~line 242) exposes two methods (`queryDBConnect`, `queryDBErrorReply`) that base64-decode a hardcoded constant to a URL on the anonymous paste host jsonkeeper.com, fetch the paste body with axios, and pipe it to the stdin of a detached `spawn(\u0027node\u0027, [])` child process. The decoded endpoints are https://www.jsonkeeper.com/b/ZIAIK and https://jsonkeeper.com/b/L435A. Whoever controls those pastes can execute arbitrary Node.js code on any host that calls either method. The base64 obfuscation of the URL constant, the use of a mutable third-party paste host, and the pipe-to-node sink are unambiguous attacker shape \u2014 there is no legitimate database-connector reason for any of these primitives. Any consumer who fat-fingered the package name and exercises the connector triggers attacker-controlled RCE.\n",
  "id": "MAL-2026-5463",
  "modified": "2026-06-18T19:21:55Z",
  "published": "2026-06-09T20:18:26Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/db-dx-connector/v/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/db-dx-connector/v/1.0.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/db-dx-connector/v/1.0.2"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in db-dx-connector (npm)"
}