MAL-2026-13621

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@decido/backend-core/MAL-2026-13621.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13621
Published
2026-08-07T17:20:59Z
Modified
2026-08-07T17:34:49.551712501Z
Summary
Malicious code in @decido/backend-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8)

The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware short-circuits JWT verification when the incoming Authorization header bearer value equals the literal string 'mock-admin-token', returning a synthesized ADMIN user and calling next() without any further validation. A second literal 'mock-token-123' grants a STUDENT identity on the same code path. Any deployment that wires this middleware into its Express app accepts these fixed strings as valid credentials, so any HTTP client that sends 'Authorization: Bearer mock-admin-token' passes requirePermission checks that gate administrative routes (user listing, role changes, permission editing). The tokens are hardcoded in published code and are effectively universal admin credentials known to anyone who inspects the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-07T17:21:27Z",
            "id": "IN-MAL-2026-017124",
            "import_time": "2026-08-07T17:23:17.307260926Z",
            "versions": [
                "4.1.18"
            ],
            "source": "amazon-inspector",
            "sha256": "0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8"
        },
        {
            "modified_time": "2026-08-07T17:21:09Z",
            "id": "IN-MAL-2026-017122",
            "import_time": "2026-08-07T17:23:17.108789142Z",
            "versions": [
                "4.1.1"
            ],
            "source": "amazon-inspector",
            "sha256": "9e7107b1a6fae7149ef860c16211be97cd9ac2c4f902501a3bf1aca6ca3c3837"
        },
        {
            "modified_time": "2026-08-07T17:20:59Z",
            "id": "IN-MAL-2026-017121",
            "import_time": "2026-08-07T17:23:16.962716406Z",
            "versions": [
                "4.1.19"
            ],
            "source": "amazon-inspector",
            "sha256": "22054cd222daafe38b79055e1318d3ee7b1e669a8985fd6c6abe813ec60af5e6"
        },
        {
            "modified_time": "2026-08-07T17:21:16Z",
            "id": "IN-MAL-2026-017123",
            "import_time": "2026-08-07T17:23:17.212928381Z",
            "versions": [
                "4.1.12"
            ],
            "source": "amazon-inspector",
            "sha256": "38ea34937f7b568c68b947cf5d4636a3b3cd0fe3e6f9cc0a10e685465e2e5e8d"
        }
    ]
}
References
Credits

Affected packages

npm / @decido/backend-core

Package

Name
@decido/backend-core
View open source insights on deps.dev
Purl
pkg:npm/%40decido/backend-core

Affected ranges

Affected versions

4.*
4.1.1
4.1.12
4.1.18
4.1.19

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "backend-core-4.1.18.tgz",
            "hashes": {
                "sha512_sri": "sha512-hNrawKoK06NhsUHhdqHVO2FhhMBmNQbZuVC9SWZpj3LFZYUJmH4yVHySfYbczRGK4IdJaeKeSxRQY3AeTkzN8w==",
                "sha1": "eeb7ebc95ee44838749bbf899d098d7b9283b486"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.js",
            "tlsh": "df32138b16fb1531067ba06d573790227d66fd0b3098c954ffbcc7a81f428a9c9e1ab4",
            "sha256": "334027796517f1c120034fc14f8367b6b072c273e591a33c88f82d1bb3859585"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@decido/backend-core/MAL-2026-13621.json"