The npm package 'db-query-log' version 1.0.1 contains malicious code that fetches and executes attacker-controlled JavaScript code at runtime. It disguises a remote code execution backdoor by decoding a hardcoded base64 URL pointing to an attacker-controlled JSON paste site, retrieving code, and executing it within the Node.js process. This behavior is hidden from static analysis and misrepresents its origin by referencing unrelated upstream repositories. Any system running this package is at risk of full compromise.