sql-limit-enforcer

Details

**Severity:** Critical

**Affected versions:** `= 10.0.0`

## Source: amazon-inspector (6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659)
Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (`node main.js`) during `npm install`. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/sql-limit-enforcer/MAL-2026-16151.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/sql-limit-enforcer/MAL-2026-16151.json
- https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.0
- https://github.com/ossf/malicious-packages/blob/3ede3241c87314af4142a1f51374fc2db67cedfb/osv/malicious/npm/sql-limit-enforcer/MAL-2026-16151.json
- https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.1
- https://www.npmjs.com/package/sql-limit-enforcer/v/10.0.2
- https://github.com/advisories/GHSA-vjjr-9qv2-mh33

Compromised versions (1)

• = 10.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.