express-rate-controller

{"schema_version":"1.7.4","id":"MAL-2026-12378","published":"2026-08-05T13:04:26Z","modified":"2026-08-05T19:07:44.062504763Z","summary":"Malicious code in express-rate-controller (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11)\nThe package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.\n","affected":[{"package":{"name":"express-rate-controller","ecosystem":"npm"},"versions":["2.0.1","2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"src/index.cjs","sha256":"007c5b5ee5dce319907fb7747fb9f621311d18c58d8081384d7a5d6c42308fbc","tlsh":"130274287cf364920b63709d45cb909c74b6e507305bda50ea6c49012fa87aca1f7bfd"},{"path":"package.json","sha256":"3f6989446cbb618591b9c3a9d208e0eeeab59de631e04d585329c0abec68bf5b","tlsh":"65117600d2661e0311cde9917c5d469a6031884749947d12378f5a7c0fccabf25fe3bd"}],"package_integrity":[{"filename":"express-rate-controller-2.0.1.tgz","hashes":{"sha1":"7aaeaf1e9c46385f7c4922ba422f7e37a333b728","sha512_sri":"sha512-QeZ+ms4WjCArQf6WOy00DgrxC75XEV61fxNlJmuYaCkJhsW06rYrXL0hYDqK18Ez6cq/zyKcPHYEaKkvFT1r9Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-rate-controller/v/2.0.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-rate-controller/v/2.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014871","import_time":"2026-08-05T13:08:52.190304761Z","modified_time":"2026-08-05T13:04:26Z","sha256":"43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11","source":"amazon-inspector","versions":["2.0.1"]},{"id":"IN-MAL-2026-015880","import_time":"2026-08-05T19:04:56.847798307Z","modified_time":"2026-08-05T18:29:21Z","sha256":"0f8f55db832d152ae267d8eecd35e28ad2fe646aa93011d3e6f30161a1d9f18f","source":"amazon-inspector","versions":["2.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}