MalwarePublished 26 Jun 2026Updated 20 Aug 2026

db-query-log (npm) · Malicious Code

Affects db-query-logSource GCVE Database

Malicious package : remove db-query-log and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6539

What to do

Remove db-query-log from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdb-query-log	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'db-query-log' version 1.0.1 contains malicious code that fetches and executes attacker-controlled JavaScript code at runtime. It disguises a remote code execution backdoor by decoding a hardcoded base64 URL pointing to an attacker-controlled JSON paste site, retrieving code, and executing it within the Node.js process. This behavior is hidden from static analysis and misrepresents its origin by referencing unrelated upstream repositories. Any system running this package is at risk of full compromise.

Impact

Any system that installs and runs 'db-query-log' version 1.0.1 is vulnerable to arbitrary remote code execution controlled by an attacker. This can lead to full system compromise, including theft or destruction of secrets, keys, and other sensitive data. Because the malicious code executes with the installer's privileges, the attacker gains extensive control over the affected environment. The compromise risk extends beyond the package itself, as attackers may have installed additional malware or backdoors.

Defensive guidance

Immediate removal of the 'db-query-log' package version 1.0.1 is strongly recommended. Systems with this package installed should be considered fully compromised. All secrets, keys, and credentials stored on affected systems must be rotated from a separate, trusted environment. Due to the high likelihood of persistent compromise, a full system rebuild or forensic investigation may be necessary to ensure eradication of attacker presence.

Summary

The 'db-query-log' npm package (version 1.0.1) includes a method queryDBConnect() that base64-decodes a hardcoded URL to an attacker-controlled JSON paste site (https://www.jsonkeeper.com/b/ZIAIK). It fetches the 'data.content' field from this URL using axios and compiles and executes the fetched JavaScript code dynamically inside the Node.js process via new Module()._compile(). The URL is stored as a base64 literal (HASH_KEY) and decoded at runtime to evade static detection. Errors in this fetch-and-execute process are silently ignored. The package metadata falsely claims to be related to the 'divbloxjs/dx-db-connector' project, but the malicious remote execution method is not part of that upstream API. This results in arbitrary code execution with the privileges of the Node.js process running the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:59 UTC

Technical details

References

Community reviews