sql-limit-enforcernpm
Advisory published Updated
sql-limit-enforcer is a confirmed malicious npm package (MAL-2026-16151) that opens a backdoor for remote access (malicious versions 10.0.0, 10.0.1, 10.0.2). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in sql-limit-enforcer (npm)
What this malware does
Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook (node main.js) during npm install. main.js collects host identifiers via require('os') — os.hostname(), os.userInfo(), os.platform(), os.arch(), process.cwd(), process.version — and POSTs them as JSON over https to the hardcoded collector URL https://webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05. The declared purpose (SQL limit enforcer) is a cover; the artifact is an install-time reconnaissance beacon.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Search your lockfiles and build artifacts for sql-limit-enforcer (3 malicious versions).
If you installed it — respond
sql-limit-enforcer establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If sql-limit-enforcer was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks sql-limit-enforcer-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.