The db-rake npm package (versions 1.0.1 and 1.0.2) includes a method resetor() that, when any Model is constructed, silently runs an unpinned npm install of the attacker-controlled db-dx-connector package using an aliased and suppressed npm install call. The installed package is then required and executed, allowing arbitrary code execution. The technique is intentionally obfuscated and confirmed by similar commented-out code targeting another package. This design enables an attacker to execute any code they publish to db-dx-connector within the victim's process, effectively compromising the host system.

Any system with db-rake versions 1.0.1 or 1.0.2 installed or running should be considered fully compromised. The malicious package can execute arbitrary code with the privileges of the running process, potentially leading to complete system takeover. All secrets and keys stored on the compromised system are at risk and must be rotated from a secure environment. Removing the db-rake package does not guarantee removal of all malicious components or persistence mechanisms.

Immediate removal of the db-rake package versions 1.0.1 and 1.0.2 is recommended. However, due to the high likelihood of full system compromise, all secrets and keys on affected machines should be rotated from a different, trusted system. Conduct a thorough forensic investigation and consider rebuilding the affected systems to ensure complete eradication of malicious code. Monitor for any suspicious activity related to the db-dx-connector package or other unexpected npm installs.