@vertexa/prisma-fetch-engine

{"modified":"2026-08-07T13:34:35Z","published":"2026-08-07T12:51:17Z","schema_version":"1.7.4","id":"MAL-2026-13608","summary":"Malicious code in @vertexa/prisma-fetch-engine (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db)\nPackage is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-engine', author 'Tim Suchanek <suchanek@prisma.io>', homepage https://www.prisma.io, bug URL github.com/prisma/prisma/issues. Its dependencies rebrand the Prisma toolchain into @vertexa/prisma-debug, @vertexa/prisma-engines-version, and @vertexa/prisma-get-platform. The engine download URL builder in the bundled dist/ chunks resolves the Prisma query-engine native binary to https://github.com/lh0x00/prisma/releases/download/engines-b436f5b358bf3b9d72861631111333dd40434f73/<binary> — a personal GitHub account unaffiliated with Prisma — rather than the official binaries.prisma.sh CDN. Sibling bundles ship additional variants pointing at github.com/lh0x00/@lamhieu/prisma/releases/... and github.com/lh0x00/@lamhieu/@lamhieu/prisma/releases/.... The fetched bytes are written to disk, chmod +x'd, and subsequently invoked by Prisma tooling as the query engine, so a consumer installing this package and running Prisma executes attacker-controlled native code as the database engine process. No hash or signature verification is performed on the downloaded binary, and the download host does not match the impersonated publisher.\n","affected":[{"package":{"ecosystem":"npm","name":"@vertexa/prisma-fetch-engine"},"versions":["7.8.2","7.8.4","7.8.5","7.8.3","7.8.1","7.8.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/chunk-CF6UJAP3.js","sha256":"51cc07aafde55f6ad4340b012e56753aa9b05d1878965dd9f563e4952088d4a9","tlsh":"e48362896afb32119e6371fdba6f501976b6c153210cdd00ba5c97e09f8503c9ae2bdc"},{"path":"package.json","sha256":"0804f54a9a3f8e1e417883d639b5c5d0873ea6afc57a8d57a2b70101a4aa75c5","tlsh":"cf117a70c563dda306cd9340dc2802439e2a585b89b8f90823cb245c1b5d89b61ff66d"}],"package_integrity":[{"filename":"prisma-fetch-engine-7.8.2.tgz","hashes":{"sha1":"c6f0fd7fec73f0d488f701431b6726d931aa130b","sha512_sri":"sha512-EI1GNxBQv76wIS52UGgsMce8xmZFMDeovgB78F4SC5sIFnV46bimXF3MCoyktTBfkBfq07Jm7kEW+kr5kn07rw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.3"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@vertexa/prisma-fetch-engine/v/7.8.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017069","import_time":"2026-08-07T13:32:43.808656284Z","modified_time":"2026-08-07T12:51:17Z","sha256":"7c61b8133ac3de70262f3496368103a2eecca87bde58bea852dbe98e167c5b05","source":"amazon-inspector","versions":["7.8.2"]},{"id":"IN-MAL-2026-017072","import_time":"2026-08-07T13:32:43.92337922Z","modified_time":"2026-08-07T12:51:40Z","sha256":"d38b1dde82fbc77be91766db56d2ced0166e330975ead1ddfef209ad947e310b","source":"amazon-inspector","versions":["7.8.4"]},{"id":"IN-MAL-2026-017070","import_time":"2026-08-07T13:32:43.852595064Z","modified_time":"2026-08-07T12:51:25Z","sha256":"d600a46705c4135e797ddabd9ce85155a55a1eb1d3af840e15d86ff3bc068aeb","source":"amazon-inspector","versions":["7.8.5"]},{"id":"IN-MAL-2026-017073","import_time":"2026-08-07T13:32:43.960401406Z","modified_time":"2026-08-07T12:51:50Z","sha256":"f28776c1fc2bab8f1ae7bcbe98723c6ed9830b4356023925052595cd60c338c6","source":"amazon-inspector","versions":["7.8.3"]},{"id":"IN-MAL-2026-017071","import_time":"2026-08-07T13:32:43.887468276Z","modified_time":"2026-08-07T12:51:33Z","sha256":"f9e623bb862332605a3fd291111a1061b5c13f1f66daff888bcff8c5db035cbf","source":"amazon-inspector","versions":["7.8.1"]},{"id":"IN-MAL-2026-017074","import_time":"2026-08-07T13:32:43.991265491Z","modified_time":"2026-08-07T12:52:03Z","sha256":"af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db","source":"amazon-inspector","versions":["7.8.0"]}]}}