The 'db-query-log' npm package (version 1.0.1) includes a method queryDBConnect() that base64-decodes a hardcoded URL to an attacker-controlled JSON paste site (https://www.jsonkeeper.com/b/ZIAIK). It fetches the 'data.content' field from this URL using axios and compiles and executes the fetched JavaScript code dynamically inside the Node.js process via new Module()._compile(). The URL is stored as a base64 literal (HASH_KEY) and decoded at runtime to evade static detection. Errors in this fetch-and-execute process are silently ignored. The package metadata falsely claims to be related to the 'divbloxjs/dx-db-connector' project, but the malicious remote execution method is not part of that upstream API. This results in arbitrary code execution with the privileges of the Node.js process running the package.

Any system that installs and runs 'db-query-log' version 1.0.1 is vulnerable to arbitrary remote code execution controlled by an attacker. This can lead to full system compromise, including theft or destruction of secrets, keys, and other sensitive data. Because the malicious code executes with the installer's privileges, the attacker gains extensive control over the affected environment. The compromise risk extends beyond the package itself, as attackers may have installed additional malware or backdoors.

No official patch or fix is currently available. Immediate removal of the 'db-query-log' package version 1.0.1 is strongly recommended. Systems with this package installed should be considered fully compromised. All secrets, keys, and credentials stored on affected systems must be rotated from a separate, trusted environment. Due to the high likelihood of persistent compromise, a full system rebuild or forensic investigation may be necessary to ensure eradication of attacker presence.