MAL-2026-13608 Malicious code in @vertexa/prisma-fetch-engine (npm)

Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-engine', author 'Tim Suchanek <[email protected]>', homepage https://www.prisma.io, bug URL github.com/prisma/prisma/issues. Its dependencies rebrand the Prisma toolchain into @vertexa/prisma-debug, @vertexa/prisma-engines-version, and @vertexa/prisma-get-platform. The engine download URL builder in the bundled dist/ chunks resolves the Prisma query-engine native binary to https://github.com/lh0x00/prisma/releases/download/engines-b436f5b358bf3b9d72861631111333dd40434f73/&lt;binary> — a personal GitHub account unaffiliated with Prisma — rather than the official binaries.prisma.sh CDN. Sibling bundles ship additional variants pointing at github.com/lh0x00/@lamhieu/prisma/releases/… and github.com/lh0x00/@lamhieu/@lamhieu/prisma/releases/…. The fetched bytes are written to disk, chmod +x'd, and subsequently invoked by Prisma tooling as the query engine, so a consumer installing this package and running Prisma executes attacker-controlled native code as the database engine process. No hash or signature verification is performed on the downloaded binary, and the download host does not match the impersonated publisher.