dbconnectify

GHSA-q53m-ch29-58cq

Malicious code in dbconnectify (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (e23c446b06120537793ebc07d748d8de5334ae4ec6779bda5368885c72216e81)
The package exposes a method queryDBConnect that performs an HTTP GET against a URL stored as a base64-encoded constant (HASH_KEY) decoded at runtime via atob(). The decoded endpoint is https://api.jsonsilo.com/public/bbc58e47-8c79-4653-ab75-d94e69230854, a third-party JSON-hosting service whose content is mutable by whoever controls the record. The fetched JavaScript source is passed to Node's internal Module._compile as "errorcheck.js", loading and executing attacker-controlled code in the installer's process. A database connector library has no functional need to load remote code, and hiding the endpoint behind base64 obfuscation is characteristic of evasion rather than legitimate configuration.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b5fd1b349861e14c184da1c3b57f840ae1df81c1/osv/malicious/npm/dbconnectify/MAL-2026-10669.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b5fd1b349861e14c184da1c3b57f840ae1df81c1/osv/malicious/npm/dbconnectify/MAL-2026-10669.json
- https://www.npmjs.com/package/dbconnectify/v/1.0.1
- https://github.com/ossf/malicious-packages/blob/4f8382c22379fc0093ad418cb40f30e203d946ed/osv/malicious/npm/dbconnectify/MAL-2026-10669.json
- https://www.npmjs.com/package/dbconnectify/v/1.0.2
- https://github.com/advisories/GHSA-q53m-ch29-58cq

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.