The 'db-plog' npm package version 1.0.1 includes a runtime dropper in its CommonJS bundle (dist/index.js) that executes a hidden 'npm install' command to fetch and load the 'db-connector-log' package, which is controlled by an attacker. This secondary package is not declared in the dependencies or documentation, and the installation is suppressed with npm flags and Windows process hiding to evade operator detection. Upon instantiating the 'Model' API, the dropper runs arbitrary code from 'db-connector-log', enabling the attacker to execute any code on the compromised system. The ESM bundle (dist/index.mjs) does not contain this malicious code, indicating a deliberate evasion technique. This design allows the attacker to update the malicious payload independently of 'db-plog' updates. The compromise is severe, as any system running this package should be considered fully compromised, requiring secret and key rotation from a clean environment.

Any system with 'db-plog' version 1.0.1 installed or running is at high risk of full compromise due to arbitrary code execution via the malicious 'db-connector-log' package installed at runtime. Attackers can execute any code, potentially exfiltrate secrets, install persistent malware, or take full control of the host. The silent and hidden installation mechanism increases the likelihood of unnoticed compromise. Removal of the package alone does not guarantee elimination of the attacker’s presence or malware.

No official patch or fix is currently available for this malicious package. Immediate removal of 'db-plog' version 1.0.1 is strongly recommended. All secrets, keys, and credentials stored on the affected system should be considered compromised and rotated from a separate, trusted environment. Due to the potential for full system compromise, a full system audit and possible rebuild may be necessary. Monitor for any signs of persistence or additional malware. Avoid using this package or any related packages from untrusted sources.