MAL-2026-13368

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-dever/MAL-2026-13368.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13368
Published
2026-08-05T18:25:27Z
Modified
2026-08-05T19:19:50.019648029Z
Summary
Malicious code in express-dever (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31)

express-dever@5.1.8 registers postinstall: node index.js in package.json, and index.js is heavily obfuscated (obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, _0x variable naming, control-flow flattening). Decoded, the script requires axios/fs/path/childprocess/os, constructs a dotted-quad host string at runtime via repeated .concat(x, '.') calls, performs axios.get(<url>), writes the response body to a file under process.cwd() with {flag:'w+'}, and spawns the written file via childprocess with windowsHide:true. This is a download-and-execute dropper that fires automatically on npm install. Corroborating signals: package.json declares a self-referential floating dependency (express-dever: ^5.1.7), author and description fields are blank, and the README instructs readers to sandbox the file — consistent with a throwaway malicious upload rather than a legitimate library.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31",
            "source": "amazon-inspector",
            "versions": [
                "5.1.8"
            ],
            "import_time": "2026-08-05T19:04:56.785945377Z",
            "modified_time": "2026-08-05T18:29:09Z",
            "id": "IN-MAL-2026-015879"
        },
        {
            "sha256": "f4bad4e01b45f62041b732eb4315d326e2411d5fc09889818568459ae4ec77c7",
            "source": "amazon-inspector",
            "versions": [
                "5.1.7"
            ],
            "import_time": "2026-08-05T19:04:55.029461474Z",
            "modified_time": "2026-08-05T18:25:27Z",
            "id": "IN-MAL-2026-015857"
        }
    ]
}
References
Credits

Affected packages

npm / express-dever

Package

Name
express-dever
View open source insights on deps.dev
Purl
pkg:npm/express-dever

Affected ranges

Affected versions

5.*
5.1.7
5.1.8

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha1": "2e61ff92bc50119da5c7dda6aec4bca4f596359e",
                "sha512_sri": "sha512-LFGkAx8v4CGKF2KrApE2wKI9tXbCkLHgk5zXNKXGMMJgHAS+JhL7LDgPJxW0hNw5C5YYoSumHvsh6XZQ7ktOtQ=="
            },
            "filename": "express-dever-5.1.8.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "a00860eab180952dff69a77cc70774d8eb5c5104bc0774ee668866ee9dc4a50f",
            "tlsh": "0c9288c83bc5b0a05733b0fbaa1bb0a6e1691c8db34d4848f797f498f968314d585b9c"
        },
        {
            "path": "package.json",
            "sha256": "1af6db90ede3ab5aaaecb1183af8b514b57ff708f9b8c6add34e00411e1d30a9",
            "tlsh": "bee0cd314d105a3325b156965c694197b7724f2f2030dc0ab1ff056c42976738cdd755"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-dever/MAL-2026-13368.json"