MAL-2026-10414

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-request-engine/MAL-2026-10414.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10414
Published
2026-07-13T06:55:20Z
Modified
2026-07-13T07:47:04.840113079Z
Summary
Malicious code in express-request-engine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30)

The package's main entry (index.js) presents itself as a normalize-path utility but on module load calls initPlugin() at top level, which performs an HTTPS fetch to https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92 and passes the response body's record.cerookie field into new (Function.constructor)('require',...), invoking it with the consumer's own require function. The result is arbitrary attacker-controlled JavaScript executing with full module-loading privileges on any process that imports the package. The destination is a mutable jsonbin document under an anonymous account, so the executed code can be changed at any time by the publisher. Obscure naming (cerookie payload field, bearrtoken: 'logo' header) and the mismatch between the advertised normalize-path purpose and the actual network fetch + Function-constructor exec indicate deliberate concealment rather than misconfiguration.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30",
            "modified_time": "2026-07-13T06:55:20Z",
            "versions": [
                "3.6.3"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009843",
            "import_time": "2026-07-13T07:40:12.581699111Z"
        }
    ]
}
References
Credits

Affected packages

npm / express-request-engine

Package

Name
express-request-engine
View open source insights on deps.dev
Purl
pkg:npm/express-request-engine

Affected ranges

Affected versions

3.*
3.6.3

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-f52PaJ2QcvXhGEqUaBGtF9V1e9/4z2kIty+wXMlzy+YqeGQdo558wT9o6m3wwy05ZHQ3T3uCMbd95q9gi5jTBg==",
                "sha1": "e9db7e9364d241d2c895b728e23e7c54903fd14f"
            },
            "filename": "express-request-engine-3.6.3.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "d5fb9d5f33e208b9ba37dc361cfc2dbf51a2c64ed0c5a890c95bd2da587a0cca",
            "tlsh": "4a41e1d924fa6115c1a3e1810e8f8409f22be1133359dac5b98c53546fd07b8a7f2b8a",
            "path": "index.js"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-request-engine/MAL-2026-10414.json"