The npm package @node-cloud/create includes a suspicious dependency @sql-trigger/nodesql that is imported but not used, indicating potential dependency smuggling. The main package acts as a wrapper for npm publishing functions but the sibling-scoped dependency may execute malicious code upon installation. Although the package itself does not contain install-time hooks or exfiltration code, the risk lies in the imported dependency which requires separate evaluation. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal. No patch or fix is currently available.