express-middle

{"modified":"2026-08-05T12:56:00Z","published":"2026-08-05T12:56:00Z","schema_version":"1.7.4","id":"MAL-2026-12376","summary":"Malicious code in express-middle (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567)\npackage.json declares postinstall: `node index.js`, which fires automatically on `npm install`. index.js is a heavily obfuscated bundle (obfuscator.io-style RC4-decoded 344-entry string array with control-flow flattening) whose runtime behavior assembles a destination host at runtime by concatenating four numeric fragments with '.' (an IPv4 built to hide the C2 from static review), performs an HTTPS request to that host, splits the response on ':' into IV and ciphertext, derives a key via pbkdf2, AES-decrypts the response with createDecipheriv, writes the plaintext payload to disk via fs.writeFileSync, and executes it through child_process.exec with `windowsHide:true` to suppress a console window. The package name resembles `express` middleware but ships no middleware functionality; the sole effect of installing it is remote code execution on the installer's machine under attacker control.\n","affected":[{"package":{"ecosystem":"npm","name":"express-middle"},"versions":["5.5.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"e540830d07c0ddfbe615270c951dfcaf35fc2e7f9a457e3a7ccf94f92dedb442","tlsh":"02b294cd3fc2f0a41627b0b72a1b6495e1796c98b38c8488f396b058fd58358e475b6c"}],"package_integrity":[{"filename":"express-middle-5.5.1.tgz","hashes":{"sha1":"90ec3c0ab563f01ecaaa23750da9534cba76b837","sha512_sri":"sha512-ODfbqPdDGtDijgNvZ+M1mG2OTn+4ZQMDW289LA9qWl/tZfwiLdTQGlDkOJQCKhFcJLkgbmPhSi6FeggwaODmlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-middle/v/5.5.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014813","import_time":"2026-08-05T13:08:48.415532228Z","modified_time":"2026-08-05T12:56:00Z","sha256":"91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567","source":"amazon-inspector","versions":["5.5.1"]}]}}