MAL-2026-12377

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-mongo-santi/MAL-2026-12377.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12377
Published
2026-08-05T12:22:09Z
Modified
2026-08-05T13:35:25.452863387Z
Summary
Malicious code in express-mongo-santi (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33)

The package's main file index.js is a heavily obfuscated bundle (obfuscator.io-style rotated string array with base64+RC4 decoders) whose only purpose is a remote-fetch-and-execute pipeline that fires when the module is require()'d. On load it pulls in os, fs, path, crypto, childprocess, and https, assembles a hardcoded IPv4 destination from four numeric octets concatenated at runtime, issues an HTTPS GET to that host, splits the response on ':' into an IV and ciphertext, derives an AES key with crypto.scryptSync, decrypts the body with createDecipheriv, writes the plaintext to a file under os.homedir(), and spawns it via childprocess with cwd set to the home directory. Module, method, and destination strings are all reconstructed at runtime through the decoders, and an uncaughtException handler suppresses errors. The package name is also a typosquat of express-mongo-sanitize. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's machine under the installer's user identity.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.1.9"
            ],
            "import_time": "2026-08-05T13:08:32.336564705Z",
            "modified_time": "2026-08-05T12:22:09Z",
            "id": "IN-MAL-2026-014634",
            "sha256": "85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / express-mongo-santi

Package

Name
express-mongo-santi
View open source insights on deps.dev
Purl
pkg:npm/express-mongo-santi

Affected ranges

Affected versions

1.*
1.1.9

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-mongo-santi/MAL-2026-12377.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "3a96c07468a2adea3fab5cdfdee801fdb557382a128b0e62b34f013400e5266d",
            "tlsh": "ceb2868d3fd2f0a04237b0f76a1b6895e13aac9cb2cc9409f7a5f058fd58354d165b68"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "ef91961b842bf0b2873d4aed31a03d71604b3841",
                "sha512_sri": "sha512-EPdfOnNOsNWGs5mO7fV1cCCRBmM6ROlQAQmWbhv8yQLcYjQaKRVzofOfMCNxVTP6vxI2Ain3z3JGskJD/ipzcA=="
            },
            "filename": "express-mongo-santi-1.1.9.tgz"
        }
    ]
}