MAL-2026-4611

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/midpatch/MAL-2026-4611.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4611
Published
2026-05-23T16:50:47Z
Modified
2026-05-26T06:02:41Z
Summary
Malicious code in midpatch (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fe668e556f4b46fce125c318ebc3bea93185c78ec36c19f8991bbcb36172a62b)

The package advertises a logger middleware (keywords fast/logger/stream/json, exports module.exports.pino = middleware, file.js wraps a ./pino module) so consumers will install and mount it as Express middleware. On first invocation, index.js spawns a detached, stdio-ignored child process running node lib/caller.js, which fetches JavaScript from https://jsonkeeper.com/b/XRGF3 (a public, attacker-mutable paste host) and evaluates the response's cookie field via new Function.constructor('require', s)(require), granting the remote payload full Node require access. The C2 URLs are base64-obfuscated inside fake process.env defaults (DEV_API_KEY: "aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz" and a second paste ID 4NAKK in lib/const.js) to evade casual review and string scanners. The combination of pino-shaped lure + detached/hidden child + remote-fetched eval from a mutable paste host + base64-hidden endpoints is unambiguous supply-chain RCE — any consumer that mounts the middleware executes attacker-controlled code.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-004364",
            "import_time": "2026-05-26T05:52:27.372963021Z",
            "modified_time": "2026-05-23T16:50:47Z",
            "sha256": "fe668e556f4b46fce125c318ebc3bea93185c78ec36c19f8991bbcb36172a62b",
            "source": "amazon-inspector",
            "versions": [
                "1.1.9"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / midpatch

Package

Name
midpatch
View open source insights on deps.dev
Purl
pkg:npm/midpatch

Affected ranges

Affected versions

1.*
1.1.9

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/caller.js",
            "sha256": "d81e48769a830cd3384a4b8977ade12e5ab7583eb7cca84e7ab966d15871bd71",
            "tlsh": "f8017b8a30fa605c015510f64b1fa4327011e4273c49e5c5378c87524fea9ae6963aed"
        },
        {
            "path": "index.js",
            "sha256": "2956b023858d706a5e241cd28b845088e5f414c5f70bd5d8cb73cb427d081065",
            "tlsh": "5d213c81b9f11188065cd9c8b569e53a38e3c4377207b9b0e9ec87862bcf2080272ad7"
        }
    ],
    "package_integrity": [
        {
            "filename": "midpatch-1.1.9.tgz",
            "hashes": {
                "sha1": "192d726516d92e6bf9aa45447596f946d888cd41",
                "sha512_sri": "sha512-VIPiJBVfM9idQEAQOR8mL2FYaIlHCo6Zb+kiKSJJfVfy+PVj0oY/xIcwxIVFWitCs/sHmAmlDrDWbIsagwzNIg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/midpatch/MAL-2026-4611.json"