@sql-access/nodesqlnpm

@sql-access/[email protected] advertises itself as SQL tooling but ships a copy of the feross/buffer library as its main entry point, with a README copied from an unrelated bare-stream package. The only functional change to the buffer source is a single top-level var ins = require('@sqlite-node/createsql'); at index.js:10. The ins binding is never used; its sole effect is to force @sqlite-node/createsql to execute its module top-level whenever a consumer does require('@sql-access/nodesql'). The package name, the transitive dependency name, the discarded require result, and the unrelated decoy code together form a deliberate loader hop that hides the real payload one dependency away. Installing or requiring this package silently runs whatever @sqlite-node/createsql ships, under the cover of a Buffer polyfill.