Supply chain · npm · High

Critical Malicious npm Package 'db-convertor' Poses Full System Compromise Risk

Threat Engine Auto-Feed · data current as of 2026-07-02

The npm package 'db-convertor' has been identified as malicious, leading to full system compromise upon installation. This poses a critical supply chain risk, requiring immediate action to rotate credentials and isolate affected systems.

  • Package: npm / db-convertor
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

A malicious version of the 'db-convertor' package was published to the npm registry. Installation of this package results in the complete compromise of the host system.

How the attack works

This is a malicious package attack where an attacker publishes a harmful package to a public registry. When developers or automated systems integrate and install this package, the malicious code executes, granting the attacker unauthorized access and control over the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • Organizations with CI/CD pipelines that pull npm dependencies
  • Any user or system that has installed 'db-convertor'

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest malicious version
  • Lack of lockfiles or failure to commit/use them
  • Internal package mirrors that have synchronized the malicious package

Blast-radius scenarios

  • An attacker gains full control over the compromised computer.
  • All secrets and keys stored on the affected computer are exposed.
  • Potential for lateral movement within the network from the compromised host.

What to do (defensive)

Detect

  • Scan dependency trees for 'db-convertor' in any version.
  • Review build logs and package installation records for 'db-convertor'.

Contain

  • Immediately isolate any system found to have 'db-convertor' installed.
  • Block 'db-convertor' from being downloaded or installed in your environment.

Remediate

  • Consider any system that installed 'db-convertor' as fully compromised.
  • Rotate all secrets and keys (e.g., API keys, credentials, tokens) that were stored on the compromised computer, performing this action from a different, trusted machine.
  • Remove the 'db-convertor' package, but acknowledge that full system control may have been lost, necessitating a rebuild or re-imaging of the compromised system.

Frontier verdict — High

Prioritize immediate identification and isolation of systems with 'db-convertor' due to critical full system compromise and credential theft risk.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.