@decido/backend-core

{"modified":"2026-08-07T17:25:00Z","published":"2026-08-07T17:20:59Z","schema_version":"1.7.4","id":"MAL-2026-13621","summary":"Malicious code in @decido/backend-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8)\nThe package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware short-circuits JWT verification when the incoming Authorization header bearer value equals the literal string 'mock-admin-token', returning a synthesized ADMIN user and calling next() without any further validation. A second literal 'mock-token-123' grants a STUDENT identity on the same code path. Any deployment that wires this middleware into its Express app accepts these fixed strings as valid credentials, so any HTTP client that sends 'Authorization: Bearer mock-admin-token' passes requirePermission checks that gate administrative routes (user listing, role changes, permission editing). The tokens are hardcoded in published code and are effectively universal admin credentials known to anyone who inspects the package.\n","affected":[{"package":{"ecosystem":"npm","name":"@decido/backend-core"},"versions":["4.1.18","4.1.1","4.1.19","4.1.12"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.js","sha256":"334027796517f1c120034fc14f8367b6b072c273e591a33c88f82d1bb3859585","tlsh":"df32138b16fb1531067ba06d573790227d66fd0b3098c954ffbcc7a81f428a9c9e1ab4"}],"package_integrity":[{"filename":"backend-core-4.1.18.tgz","hashes":{"sha1":"eeb7ebc95ee44838749bbf899d098d7b9283b486","sha512_sri":"sha512-hNrawKoK06NhsUHhdqHVO2FhhMBmNQbZuVC9SWZpj3LFZYUJmH4yVHySfYbczRGK4IdJaeKeSxRQY3AeTkzN8w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@decido/backend-core/v/4.1.18"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@decido/backend-core/v/4.1.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@decido/backend-core/v/4.1.19"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@decido/backend-core/v/4.1.12"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017124","import_time":"2026-08-07T17:23:17.307260926Z","modified_time":"2026-08-07T17:21:27Z","sha256":"0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8","source":"amazon-inspector","versions":["4.1.18"]},{"id":"IN-MAL-2026-017122","import_time":"2026-08-07T17:23:17.108789142Z","modified_time":"2026-08-07T17:21:09Z","sha256":"9e7107b1a6fae7149ef860c16211be97cd9ac2c4f902501a3bf1aca6ca3c3837","source":"amazon-inspector","versions":["4.1.1"]},{"id":"IN-MAL-2026-017121","import_time":"2026-08-07T17:23:16.962716406Z","modified_time":"2026-08-07T17:20:59Z","sha256":"22054cd222daafe38b79055e1318d3ee7b1e669a8985fd6c6abe813ec60af5e6","source":"amazon-inspector","versions":["4.1.19"]},{"id":"IN-MAL-2026-017123","import_time":"2026-08-07T17:23:17.212928381Z","modified_time":"2026-08-07T17:21:16Z","sha256":"38ea34937f7b568c68b947cf5d4636a3b3cd0fe3e6f9cc0a10e685465e2e5e8d","source":"amazon-inspector","versions":["4.1.12"]}]}}