MAL-2026-12376
Dashboard / Malicious Package / MAL-2026-12376
MAL-2026-12376
Summary: Malicious code in express-middle (npm)
Details: Source: amazon-inspector (91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567) package.json declares postinstall: `node index.js`, which fires automatically on `npm install`. index.js is a heavily obfuscated bundle (obfuscator.io-style RC4-decoded 344-entry string array with control-flow flattening) whose runtime behavior assembles a destination host at runtime by concatenating four numeric fragments with '.' (an IPv4 built to hide the C2 from static review), performs an HTTPS request to that host, splits the response on ':' into IV and ciphertext, derives a key via pbkdf2, AES-decrypts the response with createDecipheriv, writes the plaintext payload to disk via fs.writeFileSync, and executes it through child_process.exec with `windowsHide:true` to suppress a console window. The package name resembles `express` middleware but ships no middleware functionality; the sole effect of installing it is remote code execution on the installer's machine under attacker control.
Affected packages
Package
Name: express-middle
Purl: pkg:npm/express-middle
Affected ranges
Type: N/A
Events:
