MAL-2026-13621

    Dashboard / Malicious Package / MAL-2026-13621

    MAL-2026-13621

    Published: 7 Aug 2026Last Modified: 7 Aug 2026

    Summary: Malicious code in @decido/backend-core (npm)

    Details: Source: amazon-inspector (0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8) The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware short-circuits JWT verification when the incoming Authorization header bearer value equals the literal string 'mock-admin-token', returning a synthesized ADMIN user and calling next() without any further validation. A second literal 'mock-token-123' grants a STUDENT identity on the same code path. Any deployment that wires this middleware into its Express app accepts these fixed strings as valid credentials, so any HTTP client that sends 'Authorization: Bearer mock-admin-token' passes requirePermission checks that gate administrative routes (user listing, role changes, permission editing). The tokens are hardcoded in published code and are effectively universal admin credentials known to anyone who inspects the package.

    References: https://www.npmjs.com/package/@decido/backend-core/v/4.1.18, https://www.npmjs.com/package/@decido/backend-core/v/4.1.1, https://www.npmjs.com/package/@decido/backend-core/v/4.1.19, https://www.npmjs.com/package/@decido/backend-core/v/4.1.12

    Affected packages

    Package

    Name: @decido/backend-core

    Purl: pkg:npm/%40decido/backend-core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.1.18
    4.1.1
    4.1.19
    4.1.12
    MAL-2026-13621 | CVE-DB