MalwarePublished 9 Jun 2026Updated 10 Jul 2026

@sqlite-node/createsql (npm) · Malicious Code

Affects @sqlite-node/createsqlSource GCVE Database

Malicious package : remove @sqlite-node/createsql and rotate any secrets on hosts that installed it.

Data as of 12 Jul 2026, 09:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5396

What to do

Remove @sqlite-node/createsql from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@sqlite-node/createsql	Affected 1.0.2 – 1.1.5 14 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6f6f2c4e3192b71fc68681fbb8c8216a5e581e9f2baaa13954172249a8ddf5b6) The package advertises itself as a SQLite toolkit but ships no SQLite functionality. Its main entry (index.js) is a single heavily obfuscated module (obfuscator.io string-array with RC4+base64 decoders, control-flow flattening, 233-entry rotated string array). After deobfuscation, a top-level IIFE runs at require() time: it builds a 4-octet IP address via repeated string concatenation, performs an HTTP GET to that hardcoded remote host, writes the response bytes to a file in an OS directory via fs.writeFileSync, then invokes child_process.exec on the dropped file with `windowsHide: true` to hide the console window. Empty `uncaughtException` / `unhandledRejection` handlers and surrounding try/catch swallow errors to avoid drawing attention. Package metadata further reinforces the lure shape: the `@sqlite-node` scope and `createsql` name imply an official SQLite toolkit, but the repository field points at an unrelated `guilderguzman/array-utl_nodelump` project and the package contains no SQLite implementation. Any project that runs `npm install @sqlite-node/createsql` and then imports the package will have arbitrary attacker-controlled code fetched and executed on the developer/CI machine. ## Source: ghsa-malware (84ca8fe36bdf66dfe770fa3a87a63ec8927a78152f2dd84515d6e1804ab59fa8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Systems that install and run this package are fully compromised, as the package downloads and executes arbitrary code from a remote attacker-controlled server. This can lead to unauthorized access, data theft, and persistent malware presence. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors.

Defensive guidance

The recommended mitigation is to immediately remove the @sqlite-node/createsql package from all affected systems. Treat any system that has installed or run this package as fully compromised. Rotate all secrets and keys that were stored or accessible on the affected machines from a different, secure system. Conduct a thorough investigation and remediation of the affected environment to identify and remove any additional malware or persistence mechanisms.

Summary

The @sqlite-node/createsql npm package (versions >=1.0.1 <=1.1.7) is a malicious package that masquerades as a SQLite toolkit but contains no legitimate SQLite code. Its main module is heavily obfuscated and, upon import, constructs a hardcoded IP address and performs an HTTP GET request to download a payload. This payload is saved to disk and executed with hidden console windows, while error handling suppresses any exceptions to avoid detection. The package metadata misleads users by implying official SQLite functionality, but the repository points to an unrelated project. Any system that installs and imports this package risks arbitrary code execution controlled by an attacker, leading to full system compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 12:37 UTC

Technical details

References

Community reviews