MAL-2026-13608

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db) Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled '# @prisma/fetch-engine', author 'Tim Suchanek <suchanek@prisma.io>', homepage https://www.prisma.io, bug URL github.com/prisma/prisma/issues. Its dependencies rebrand the Prisma toolchain into @vertexa/prisma-debug, @vertexa/prisma-engines-version, and @vertexa/prisma-get-platform. The engine download URL builder in the bundled dist/ chunks resolves the Prisma query-engine native binary to https://github.com/lh0x00/prisma/releases/download/engines-b436f5b358bf3b9d72861631111333dd40434f73/<binary> — a personal GitHub account unaffiliated with Prisma — rather than the official binaries.prisma.sh CDN. Sibling bundles ship additional variants pointing at github.com/lh0x00/@lamhieu/prisma/releases/... and github.com/lh0x00/@lamhieu/@lamhieu/prisma/releases/.... The fetched bytes are written to disk, chmod +x'd, and subsequently invoked by Prisma tooling as the query engine, so a consumer installing this package and running Prisma executes attacker-controlled native code as the database engine process. No hash or signature verification is performed on the downloaded binary, and the download host does not match the impersonated publisher.