MAL-2026-13368

    Dashboard / Malicious Package / MAL-2026-13368

    MAL-2026-13368

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in express-dever (npm)

    Details: Source: amazon-inspector (e127c5f6a6747ae491acb2166ed55c1e6aba47aca1166ade97bf084b5dbbce31) [email protected] registers `postinstall: node index.js` in package.json, and index.js is heavily obfuscated (obfuscator.io-style rotated string array with RC4/base64 decoders, hex-numeric constant folding, `_0x` variable naming, control-flow flattening). Decoded, the script requires axios/fs/path/child_process/os, constructs a dotted-quad host string at runtime via repeated `.concat(x, '.')` calls, performs `axios.get(<url>)`, writes the response body to a file under `process.cwd()` with `{flag:'w+'}`, and spawns the written file via child_process with `windowsHide:true`. This is a download-and-execute dropper that fires automatically on `npm install`. Corroborating signals: package.json declares a self-referential floating dependency (`express-dever: ^5.1.7`), author and description fields are blank, and the README instructs readers to sandbox the file — consistent with a throwaway malicious upload rather than a legitimate library.

    References: https://www.npmjs.com/package/express-dever/v/5.1.8, https://www.npmjs.com/package/express-dever/v/5.1.7

    Affected packages

    Package

    Name: express-dever

    Purl: pkg:npm/express-dever

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    5.1.8
    5.1.7