The npm package @sqlite-panel/createsql version 1.0.0 contains malicious code that fetches and executes JavaScript from a third-party GitHub Gist at load time using eval(). This allows arbitrary code execution with full Node.js process privileges on any machine that imports or requires the package. The package does not provide any legitimate SQLite functionality and appears designed to lure developers searching for SQLite tools. The remote code source is mutable and uncontrolled, posing a significant security risk.