{"id":"MAL-2026-13368","summary":"Malicious code in express-dever (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31)\nexpress-dever@5.1.8 registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, `_0x` variable naming, control-flow flattening). Decoded, the script requires axios/fs/path/child_process/os, constructs a dotted-quad host string at runtime via repeated `.concat(x, '.')` calls, performs `axios.get(\u003curl\u003e)`, writes the response body to a file under `process.cwd()` with `{flag:'w+'}`, and spawns the written file via child_process with `windowsHide:true`. This is a download-and-execute dropper that fires automatically on `npm install`. Corroborating signals: package.json declares a self-referential floating dependency (`express-dever: ^5.1.7`), author and description fields are blank, and the README instructs readers to sandbox the file — consistent with a throwaway malicious upload rather than a legitimate library.\n","modified":"2026-08-05T19:19:50.019648029Z","published":"2026-08-05T18:25:27Z","database_specific":{"malicious-packages-origins":[{"sha256":"e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31","source":"amazon-inspector","versions":["5.1.8"],"id":"IN-MAL-2026-015879","import_time":"2026-08-05T19:04:56.785945377Z","modified_time":"2026-08-05T18:29:09Z"},{"sha256":"f4bad4e01b45f62041b732eb4315d326e2411d5fc09889818568459ae4ec77c7","source":"amazon-inspector","versions":["5.1.7"],"id":"IN-MAL-2026-015857","import_time":"2026-08-05T19:04:55.029461474Z","modified_time":"2026-08-05T18:25:27Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-dever/v/5.1.8"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-dever/v/5.1.7"}],"affected":[{"package":{"name":"express-dever","ecosystem":"npm","purl":"pkg:npm/express-dever"},"versions":["5.1.8","5.1.7"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"a00860eab180952dff69a77cc70774d8eb5c5104bc0774ee668866ee9dc4a50f","tlsh":"0c9288c83bc5b0a05733b0fbaa1bb0a6e1691c8db34d4848f797f498f968314d585b9c"},{"path":"package.json","sha256":"1af6db90ede3ab5aaaecb1183af8b514b57ff708f9b8c6add34e00411e1d30a9","tlsh":"bee0cd314d105a3325b156965c694197b7724f2f2030dc0ab1ff056c42976738cdd755"}],"package_integrity":[{"filename":"express-dever-5.1.8.tgz","hashes":{"sha1":"2e61ff92bc50119da5c7dda6aec4bca4f596359e","sha512_sri":"sha512-LFGkAx8v4CGKF2KrApE2wKI9tXbCkLHgk5zXNKXGMMJgHAS+JhL7LDgPJxW0hNw5C5YYoSumHvsh6XZQ7ktOtQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-dever/MAL-2026-13368.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}