{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "index.js",
              "sha256": "fdd4079dacc0597f3de3d409fac53448930461eeb38a9569888f4110a43ceec2",
              "tlsh": "f3723f0637f72527017b7064a6cb4080a539f41b2b35d864be5cc6715fa87b8bda37d8"
            },
            {
              "path": "package.json",
              "sha256": "ab7f3efdaf879c3d0608510084e05f401a431e4a8ea6340f70ac9e2a02b3f8cb",
              "tlsh": "38016835c9201ca326ab36984c555205b12190ebcf08fd4077dc516c8f6e29f22aa3ae"
            }
          ],
          "package_integrity": [
            {
              "filename": "db-connector-log-1.0.0.tgz",
              "hashes": {
                "sha1": "9f34821eca98d0586b1762ca073c58ea47f2458f",
                "sha512_sri": "sha512-c6OKNNuEnh/sdfnkLYSDaEk5InSvnJ/ykyStsYHWEzwwQiYmBgNODAJaxHAVR1U3O/nTK9herUxe17TpfM0blg=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "db-connector-log"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007038",
        "import_time": "2026-06-18T23:09:38.905783252Z",
        "modified_time": "2026-06-18T22:29:10Z",
        "sha256": "6828cdaf9f4280f7739fd6f5a838a63ea7bc8f7bb0c94eec52fb881c2701c724",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6828cdaf9f4280f7739fd6f5a838a63ea7bc8f7bb0c94eec52fb881c2701c724)\nThe package impersonates the legitimate dx-db-connector (the package.json repository field points at git+https://github.com/divbloxjs/dx-db-connector.git) and replicates that connector\u0027s API surface, while adding an undocumented method queryDBConnect on the exported class. queryDBConnect base64-decodes a hardcoded URL (stored in a variable misleadingly named HASH_KEY and decoded with atob to evade static URL scanners), HTTP-GETs https://jsonkeeper.com/b/L435A \u2014 an anonymous, mutable JSON paste host \u2014 extracts the response\u0027s.session field, spawns a detached node child process, and writes that attacker-controlled content to its stdin, executing arbitrary JavaScript on the installer\u0027s machine. The combination of name impersonation, base64 URL obfuscation, anonymous mutable host, and stdin-piped node execution is a textbook remote-code-execution dropper. While the malicious method requires a caller to invoke it, it sits on the class consumers instantiate as the DB connector and resembles the surrounding DB methods, so normal use of the advertised API can reach it.\n",
  "id": "MAL-2026-6142",
  "modified": "2026-06-18T22:29:10Z",
  "published": "2026-06-18T22:29:10Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/db-connector-log/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in db-connector-log (npm)"
}