# MAL-2026-5464: Malicious code in db-xorma (npm)


- **Type:** Malicious package
- **Package:** `db-xorma` (npm)
- **Published:** 9 Jun 2026

## What is MAL-2026-5464?

MAL-2026-5464 is a malicious package in db-xorma, published on 9 Jun 2026. 

### Official description

db-xorma advertises itself as a reactive in-memory database library. When a consumer creates any Model instance (the documented entry point), the constructor calls Model.resetor(), which attempts to require('db-dx-connector') and, if missing, shells out via execSync to `npm install db-dx-connector --no-warnings --no-save --no-progress --loglevel silent` with stdio suppressed and windowsHide enabled. It then immediately requires the freshly-fetched package and invokes `new DxDatabaseConnector({}).queryDBConnect()`. The fetched dependency is unpinned (whatever the attacker publishes at the moment of execution will run), --no-save evades the consumer's package.json/lockfile, and output is silenced. This is a runtime-dropper pattern that gives the publisher of db-dx-connector arbitrary code execution inside any process that imports db-xorma and constructs a Model. Additionally, package.json declares a dependency on 'child_process' ^1.0.2 — a known typosquat of the Node core module name, which adds an additional attacker-controlled code path via that package's own install lifecycle. A commented-out variant of the same dropper template targeting 'clsx-js' remains in dist/index.js, indicating the pattern is iterated across package names.

## What should I do about MAL-2026-5464?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-5464 is a malicious package: db-xorma (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-5464/ (Markdown: https://insights.sbomify.com/MAL-2026-5464/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-5464

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-5464/
Summaries are generated and may contain mistakes; the official description above is the record.