The npm package @sql-access/nodesql is a malicious decoy package that misrepresents its functionality and silently executes attacker-controlled code. It masquerades as a SQL/Node utility but contains unrelated code copied from a Buffer polyfill and injects a dynamic import of a separate malicious package (@sqlite-node/createsql). Installing or requiring this package results in the execution of untrusted code, potentially compromising the host system. The package versions explicitly identified as affected include multiple 1.0.x and 1.1.x releases. Due to the nature of the attack, any system with this package installed should be considered fully compromised, and secrets should be rotated immediately. No official patch or remediation is provided, and removal alone may not fully restore system integrity.