MAL-2026-12378

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-rate-controller/MAL-2026-12378.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12378
Published
2026-08-05T13:04:26Z
Modified
2026-08-05T19:19:51.060856663Z
Summary
Malicious code in express-rate-controller (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11)

The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014871",
            "sha256": "43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11",
            "versions": [
                "2.0.1"
            ],
            "import_time": "2026-08-05T13:08:52.190304761Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T13:04:26Z"
        },
        {
            "id": "IN-MAL-2026-015880",
            "sha256": "0f8f55db832d152ae267d8eecd35e28ad2fe646aa93011d3e6f30161a1d9f18f",
            "versions": [
                "2.0.0"
            ],
            "import_time": "2026-08-05T19:04:56.847798307Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T18:29:21Z"
        }
    ]
}
References
Credits

Affected packages

npm / express-rate-controller

Package

Name
express-rate-controller
View open source insights on deps.dev
Purl
pkg:npm/express-rate-controller

Affected ranges

Affected versions

2.*
2.0.0
2.0.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "express-rate-controller-2.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-QeZ+ms4WjCArQf6WOy00DgrxC75XEV61fxNlJmuYaCkJhsW06rYrXL0hYDqK18Ez6cq/zyKcPHYEaKkvFT1r9Q==",
                "sha1": "7aaeaf1e9c46385f7c4922ba422f7e37a333b728"
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "007c5b5ee5dce319907fb7747fb9f621311d18c58d8081384d7a5d6c42308fbc",
            "tlsh": "130274287cf364920b63709d45cb909c74b6e507305bda50ea6c49012fa87aca1f7bfd",
            "path": "src/index.cjs"
        },
        {
            "sha256": "3f6989446cbb618591b9c3a9d208e0eeeab59de631e04d585329c0abec68bf5b",
            "tlsh": "65117600d2661e0311cde9917c5d469a6031884749947d12378f5a7c0fccabf25fe3bd",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-rate-controller/MAL-2026-12378.json"