MAL-2026-12174

    Dashboard / Malicious Package / MAL-2026-12174

    MAL-2026-12174

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in cors-update (npm)

    Details: Source: amazon-inspector (59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5) Package impersonates the widely-used `cors` Express middleware. lib/index.js copies the legitimate `expressjs/cors` source but adds an exported `getPlugin` factory that issues an HTTPS GET to a hardcoded URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (`rejectUnauthorized: false`) and passes the response body to `new Function('require', data.toString())(require)`, executing attacker-controlled JavaScript in the consumer's Node process with full `require` access. Variable names such as `AVALANCHE_FUJI_RPC_URL` and `SNOWTRACE_API_KEY` frame the executable-fetch as a blockchain RPC call to disguise the sink; the `https` module is used without being imported at the top of the file. Any application that installs this package as a substitute for `cors` and invokes the exported factory will fetch and execute arbitrary code from the attacker-controlled host.

    References: https://www.npmjs.com/package/cors-update/v/2.8.4, https://www.npmjs.com/package/cors-update/v/1.0.0, https://www.npmjs.com/package/cors-update/v/2.8.3, https://www.npmjs.com/package/cors-update/v/1.0.1, https://www.npmjs.com/package/cors-update/v/2.8.0

    Affected packages

    Package

    Name: cors-update

    Purl: pkg:npm/cors-update

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.8.4
    2.8.3
    2.8.0