The @sqlite-frame/nodesql npm package versions 1.0.2 and 1.0.3 is a malicious package that includes a near-verbatim copy of the feross/buffer library but injects a top-level dynamic import statement for the sibling package @sqlite-frame/createsql. This import causes the sibling package's code to execute automatically when @sqlite-frame/nodesql is required, without user consent or awareness. The package's README and metadata are deceptive, presenting it as a different library (bare-stream) and providing misleading installation instructions. This behavior effectively smuggles additional malicious code into the dependency graph, making it a lure/wrapper package designed to execute unauthorized code.

The malicious dynamic import causes unauthorized code execution within the consumer's Node.js process, potentially leading to compromise of the environment where the package is installed. The deception in package naming, metadata, and documentation increases the risk of inadvertent installation and execution of malicious code. No known exploits in the wild have been reported at this time.

No official patch or fix is currently available for this malicious package. Users should avoid installing @sqlite-frame/nodesql versions 1.0.2 and 1.0.3. Remove these versions from any projects and dependency graphs. Verify the authenticity of npm packages before installation, especially those with suspicious or inconsistent metadata. Consider using trusted package sources and tools that detect malicious packages.