MAL-2026-6211

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apiwizards/auth-middleware/MAL-2026-6211.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6211
Published
2026-06-19T15:03:53Z
Modified
2026-06-23T17:01:29.519292203Z
Summary
Malicious code in @apiwizards/auth-middleware (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (718ca10ce0670edf6756b4ff0bd05e43526ebd516396a34074acf844116e7254)

@apiwizards/auth-middleware@5.1.2 ships a single heavily obfuscated index.js (obfuscator.io string-array with 317 entries, RC4+base64 decoder, array-rotation self-defending wrapper) that is the package's declared main. On require(), a top-level IIFE loads os/fs/childprocess/crypto/path and an HTTP client, performs an HTTPS GET against a hardcoded URL constructed from a base concatenated with the package version, splits the response on ':' into key/iv/ciphertext, AES-decrypts the body via crypto.createDecipheriv, writes the cleartext to a file under os.tmpdir() with flag 'w+', and executes it via childprocess (execSync with windowsHide and a cwd derived from process.cwd()). No hash or signature verification is performed and errors are silenced via process.on('uncaughtException'). The package advertises itself as an auth middleware but ships no module.exports, no auth/login/verify/sign symbols, and empty description/author/keywords — the entire payload is the dropper. Any consumer that installs the package and require()s it (directly or transitively) will execute attacker-controlled bytes fetched from a non-publisher endpoint.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-06-19T15:41:55.448208979Z",
            "source": "amazon-inspector",
            "sha256": "ba0f33946c3dd0624d21c0e99beb12f22b880bc126a3474753b38a9799fc5293",
            "versions": [
                "4.7.0"
            ],
            "id": "IN-MAL-2026-007075",
            "modified_time": "2026-06-19T15:03:53Z"
        },
        {
            "import_time": "2026-06-23T16:54:12.529391824Z",
            "source": "amazon-inspector",
            "sha256": "718ca10ce0670edf6756b4ff0bd05e43526ebd516396a34074acf844116e7254",
            "versions": [
                "5.1.2"
            ],
            "id": "IN-MAL-2026-007260",
            "modified_time": "2026-06-23T16:08:10Z"
        }
    ]
}
References
Credits

Affected packages

npm / @apiwizards/auth-middleware

Package

Name
@apiwizards/auth-middleware
View open source insights on deps.dev
Purl
pkg:npm/%40apiwizards%2Fauth-middleware

Affected ranges

Affected versions

4.*
4.7.0
5.*
5.1.2

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "709296c83bc1f0a05333f0b7ba1bb0a6e1695c8cb2499445f797b498fd68714e4967a8",
            "sha256": "a8cf7aea481751cd84e6671ed5be2de5360ee1e316c7733b34735084996618fb",
            "path": "index.js"
        },
        {
            "tlsh": "a0e072242a72043304c822250c2da423b6a2cf6f042c3c0823cf692c83ce03328fe34c",
            "sha256": "e18a36b14a42b6261f197d59024f4be723bd868b05ff187a160d57aa0910a632",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "filename": "auth-middleware-4.7.0.tgz",
            "hashes": {
                "sha1": "adfbacc90cccbe74061157b5ea2be460a270e980",
                "sha512_sri": "sha512-3YZSLSmZ9/pe1fL1whkculi+4CTM9gyzJNkJGlwndjkgDlVMHxvfjhg8dKfiqTsu91GSVsPJIKfD6Ud51laTng=="
            }
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    },
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@apiwizards/auth-middleware/MAL-2026-6211.json"