@sqlite-group/sql-creator

{"modified":"2026-07-14T13:37:40Z","published":"2026-07-14T10:35:02Z","schema_version":"1.7.4","id":"MAL-2026-10578","aliases":["GHSA-pgxx-98xj-2gvg"],"summary":"Malicious code in @sqlite-group/sql-creator (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4d3bd76c01604d26251c1650c71f8a99ad32c5389c4e42795477ae660be33a2a)\nThe package is published under a scope that impersonates SQLite (`@sqlite-group`) and declares itself as \"cloud definitions for node\", but the shipped `index.js` is a near-verbatim copy of the feross/buffer library with a single injected top-level statement: `var ins = import('@sqlite-group/schema-generator');`. This dynamic import fires on any `require`/`import` of the package, handing control to whatever top-level module code the sibling `@sqlite-group/schema-generator` ships. The cover-story mismatch (scope name suggesting SQLite tooling + description claiming cloud definitions + actual code being a Buffer polyfill + one injected loader line) is consistent with a dependency-confusion / namespace-piggyback loader stub whose sole purpose is to pull an attacker-controlled sibling into the installer's process on load. Installer harm is the code execution surface exposed by the sibling dependency, delivered transitively when this package is required.\n\n## Source: ghsa-malware (f3e579a4512657fc706009a1d42288324dd5a9f02062bfaea96d716670adcc39)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"ecosystem":"npm","name":"@sqlite-group/sql-creator"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"bda99a87d959361da6c87d9e3a2ae125e484e23ecb948485d68546e7b01f4b97","tlsh":"793364026f52511b4377b33d984f950efb769436422ac8c8b49c94902fb4964cabbef9"},{"path":"package.json","sha256":"11832f9b907dc06fe2c491dc0ed87d85a326e8e9cc0d300a3830ac585e4a562e","tlsh":"81019e75c9318b270ed516958d641546b2715d0b8c0c7c6e33c7410dcb4f67b22fd29c"}]}}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pgxx-98xj-2gvg"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@sqlite-group/sql-creator/v/1.0.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"source":"ghsa-malware","sha256":"f3e579a4512657fc706009a1d42288324dd5a9f02062bfaea96d716670adcc39","import_time":"2026-07-14T10:52:39.047173492Z","id":"GHSA-pgxx-98xj-2gvg","modified_time":"2026-07-14T10:35:02Z","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"amazon-inspector","sha256":"4d3bd76c01604d26251c1650c71f8a99ad32c5389c4e42795477ae660be33a2a","import_time":"2026-07-14T13:35:47.498602215Z","id":"IN-MAL-2026-010486","modified_time":"2026-07-14T12:46:56Z","versions":["1.0.7"]}]}}