The @vertexa/prisma-fetch-engine npm package masquerades as the official @prisma/fetch-engine but is published under the @vertexa scope. It rebrands Prisma toolchain dependencies and downloads the Prisma query-engine native binary from a personal GitHub repository unrelated to the official Prisma source. The downloaded binary is saved to disk, made executable, and invoked by Prisma tooling without any hash or signature verification, enabling execution of attacker-controlled native code. This represents a supply chain compromise through a malicious package that can execute arbitrary code on the host system.

Consumers installing and running this package will execute attacker-controlled native code with the privileges of the Prisma tooling process. This can lead to full system compromise, data theft, or further malicious activity. The lack of integrity verification and use of an untrusted download source increases the risk of undetected malicious payload execution.

No official patch or remediation is currently documented. Users should avoid installing or using the @vertexa/prisma-fetch-engine package and verify that they are using the official Prisma packages from trusted sources. Monitor for updates from Prisma or npm advisories regarding this malicious package. Consider removing any installations of this package and scanning affected systems for compromise.