MAL-2026-10490

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (bb20d0c9e601940f84c676cd74d174e06a740b6bcb90c12d38cdcecc6ca68696) The package's main entry point (index.js) fetches a hardcoded GitHub Gist owned by 'getchainverse' via api.github.com and passes the returned file content directly to eval() at load time. Any consumer that require()s or imports @sqlite-panel/createsql executes whatever JavaScript the gist owner has published, with full Node.js process privileges on the installer's machine. The gist source is mutable and controlled by a third party, with no pinning, hash, or signature verification. The package ships no SQL functionality despite its name; the entire module is the remote-eval dropper. Package metadata (author, description) is empty, and the name appears designed to attract developers searching for SQLite tooling.