express-dever

{"modified":"2026-08-05T19:07:44Z","published":"2026-08-05T18:25:27Z","schema_version":"1.7.4","id":"MAL-2026-13368","summary":"Malicious code in express-dever (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31)\nexpress-dever@5.1.8 registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, `_0x` variable naming, control-flow flattening). Decoded, the script requires axios/fs/path/child_process/os, constructs a dotted-quad host string at runtime via repeated `.concat(x, '.')` calls, performs `axios.get(<url>)`, writes the response body to a file under `process.cwd()` with `{flag:'w+'}`, and spawns the written file via child_process with `windowsHide:true`. This is a download-and-execute dropper that fires automatically on `npm install`. Corroborating signals: package.json declares a self-referential floating dependency (`express-dever: ^5.1.7`), author and description fields are blank, and the README instructs readers to sandbox the file — consistent with a throwaway malicious upload rather than a legitimate library.\n","affected":[{"package":{"ecosystem":"npm","name":"express-dever"},"versions":["5.1.8","5.1.7"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"a00860eab180952dff69a77cc70774d8eb5c5104bc0774ee668866ee9dc4a50f","tlsh":"0c9288c83bc5b0a05733b0fbaa1bb0a6e1691c8db34d4848f797f498f968314d585b9c"},{"path":"package.json","sha256":"1af6db90ede3ab5aaaecb1183af8b514b57ff708f9b8c6add34e00411e1d30a9","tlsh":"bee0cd314d105a3325b156965c694197b7724f2f2030dc0ab1ff056c42976738cdd755"}],"package_integrity":[{"filename":"express-dever-5.1.8.tgz","hashes":{"sha1":"2e61ff92bc50119da5c7dda6aec4bca4f596359e","sha512_sri":"sha512-LFGkAx8v4CGKF2KrApE2wKI9tXbCkLHgk5zXNKXGMMJgHAS+JhL7LDgPJxW0hNw5C5YYoSumHvsh6XZQ7ktOtQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-dever/v/5.1.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-dever/v/5.1.7"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015879","import_time":"2026-08-05T19:04:56.785945377Z","modified_time":"2026-08-05T18:29:09Z","sha256":"e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31","source":"amazon-inspector","versions":["5.1.8"]},{"id":"IN-MAL-2026-015857","import_time":"2026-08-05T19:04:55.029461474Z","modified_time":"2026-08-05T18:25:27Z","sha256":"f4bad4e01b45f62041b732eb4315d326e2411d5fc09889818568459ae4ec77c7","source":"amazon-inspector","versions":["5.1.7"]}]}}