midpatch

{"modified":"2026-05-23T16:50:47Z","published":"2026-05-23T16:50:47Z","schema_version":"1.7.4","id":"MAL-2026-4611","summary":"Malicious code in midpatch (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (fe668e556f4b46fce125c318ebc3bea93185c78ec36c19f8991bbcb36172a62b)\nThe package advertises a logger middleware (keywords fast/logger/stream/json, exports `module.exports.pino = middleware`, file.js wraps a `./pino` module) so consumers will install and mount it as Express middleware. On first invocation, index.js spawns a detached, stdio-ignored child process running `node lib/caller.js`, which fetches JavaScript from `https://jsonkeeper.com/b/XRGF3` (a public, attacker-mutable paste host) and evaluates the response's `cookie` field via `new Function.constructor('require', s)(require)`, granting the remote payload full Node `require` access. The C2 URLs are base64-obfuscated inside fake `process.env` defaults (`DEV_API_KEY: \"aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz\"` and a second paste ID `4NAKK` in lib/const.js) to evade casual review and string scanners. The combination of pino-shaped lure + detached/hidden child + remote-fetched eval from a mutable paste host + base64-hidden endpoints is unambiguous supply-chain RCE — any consumer that mounts the middleware executes attacker-controlled code.\n","affected":[{"package":{"ecosystem":"npm","name":"midpatch"},"versions":["1.1.9"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/caller.js","sha256":"d81e48769a830cd3384a4b8977ade12e5ab7583eb7cca84e7ab966d15871bd71","tlsh":"f8017b8a30fa605c015510f64b1fa4327011e4273c49e5c5378c87524fea9ae6963aed"},{"path":"index.js","sha256":"2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065","tlsh":"5d213c81b9f11188065cd9c8b569e53a38e3c4377207b9b0e9ec87862bcf2080272ad7"}],"package_integrity":[{"filename":"midpatch-1.1.9.tgz","hashes":{"sha1":"192d726516d92e6bf9aa45447596f946d888cd41","sha512_sri":"sha512-VIPiJBVfM9idQEAQOR8mL2FYaIlHCo6Zb+kiKSJJfVfy+PVj0oY/xIcwxIVFWitCs/sHmAmlDrDWbIsagwzNIg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/midpatch/v/1.1.9"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-004364","import_time":"2026-05-26T05:52:27.372963021Z","modified_time":"2026-05-23T16:50:47Z","sha256":"fe668e556f4b46fce125c318ebc3bea93185c78ec36c19f8991bbcb36172a62b","source":"amazon-inspector","versions":["1.1.9"]}]}}