MAL-2026-12378

    Dashboard / Malicious Package / MAL-2026-12378

    MAL-2026-12378

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in express-rate-controller (npm)

    Details: Source: amazon-inspector (43c2ed4e91378e1ca9df444de58c0ff3afebce39741ab67011b55490740cac11) The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.

    References: https://www.npmjs.com/package/express-rate-controller/v/2.0.1, https://www.npmjs.com/package/express-rate-controller/v/2.0.0

    Affected packages

    Package

    Name: express-rate-controller

    Purl: pkg:npm/express-rate-controller

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.1
    2.0.0
    MAL-2026-12378 | CVE-DB