MAL-2026-12377
Dashboard / Malicious Package / MAL-2026-12377
MAL-2026-12377
Summary: Malicious code in express-mongo-santi (npm)
Details: Source: amazon-inspector (85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33) The package's main file index.js is a heavily obfuscated bundle (obfuscator.io-style rotated string array with base64+RC4 decoders) whose only purpose is a remote-fetch-and-execute pipeline that fires when the module is require()'d. On load it pulls in os, fs, path, crypto, child_process, and https, assembles a hardcoded IPv4 destination from four numeric octets concatenated at runtime, issues an HTTPS GET to that host, splits the response on ':' into an IV and ciphertext, derives an AES key with crypto.scryptSync, decrypts the body with createDecipheriv, writes the plaintext to a file under os.homedir(), and spawns it via child_process with cwd set to the home directory. Module, method, and destination strings are all reconstructed at runtime through the decoders, and an uncaughtException handler suppresses errors. The package name is also a typosquat of express-mongo-sanitize. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's machine under the installer's user identity.
Affected packages
Package
Name: express-mongo-santi
Purl: pkg:npm/express-mongo-santi
Affected ranges
Type: N/A
Events:
