MAL-2026-12376

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-middle/MAL-2026-12376.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12376
Published
2026-08-05T12:56:00Z
Modified
2026-08-05T13:35:24.615730649Z
Summary
Malicious code in express-middle (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567)

package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle (obfuscator.io-style RC4-decoded 344-entry string array with control-flow flattening) whose runtime behavior assembles a destination host at runtime by concatenating four numeric fragments with '.' (an IPv4 built to hide the C2 from static review), performs an HTTPS request to that host, splits the response on ':' into IV and ciphertext, derives a key via pbkdf2, AES-decrypts the response with createDecipheriv, writes the plaintext payload to disk via fs.writeFileSync, and executes it through child_process.exec with windowsHide:true to suppress a console window. The package name resembles express middleware but ships no middleware functionality; the sole effect of installing it is remote code execution on the installer's machine under attacker control.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T12:56:00Z",
            "source": "amazon-inspector",
            "sha256": "91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567",
            "import_time": "2026-08-05T13:08:48.415532228Z",
            "id": "IN-MAL-2026-014813",
            "versions": [
                "5.5.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / express-middle

Package

Name
express-middle
View open source insights on deps.dev
Purl
pkg:npm/express-middle

Affected ranges

Affected versions

5.*
5.5.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "express-middle-5.5.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-ODfbqPdDGtDijgNvZ+M1mG2OTn+4ZQMDW289LA9qWl/tZfwiLdTQGlDkOJQCKhFcJLkgbmPhSi6FeggwaODmlg==",
                "sha1": "90ec3c0ab563f01ecaaa23750da9534cba76b837"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "02b294cd3fc2f0a41627b0b72a1b6495e1796c98b38c8488f396b058fd58358e475b6c",
            "sha256": "e540830d07c0ddfbe615270c951dfcaf35fc2e7f9a457e3a7ccf94f92dedb442",
            "path": "index.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-middle/MAL-2026-12376.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]