The dbconnectify package version 1.0.1 exposes a method named queryDBConnect that base64-decodes a hardcoded URL pointing to a third-party mutable key-value store. It performs an HTTP GET request to this URL, extracts a string from the response field data.record.cookie, and executes this string as Node.js code using Module._compile. The endpoint owner can change the payload at any time, enabling arbitrary remote code execution for any caller of this method. Execution errors are silently ignored, and the malicious behavior is disguised by using unrelated field names and base64 encoding.

Any user invoking the queryDBConnect method in dbconnectify 1.0.1 is vulnerable to arbitrary remote code execution controlled by the attacker who manages the third-party payload URL. This can lead to full compromise of the environment running the package code. The malicious functionality is hidden within a package that purports to be a database connector, increasing the risk of unnoticed exploitation.

No official patch or remediation is currently available for dbconnectify 1.0.1. Users should immediately cease using this package and remove it from their projects. Avoid invoking the queryDBConnect method or any functionality from this package. Monitor for updates from the package maintainers or the npm registry for any official fixes or advisories.