Malicious code in monitoring-agent (npm)

Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP request to a hardcoded author-controlled host at...

Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

MAL-2026-17515 Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

Malicious Package

Overview epic-okta-express-middleware is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in express-middleware-ip-blocker (npm)

The package express-middleware-ip-blocker was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in epic-okta-express-middleware (npm)

Source: amazon-inspector 236ca6a4112270418e1024dd6136da781ae916d8e5e2db49347e687cd5c85ac0 The package epic-okta-express-middleware was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cluep-express-middleware (npm)

The package cluep-express-middleware was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...

Malicious code in chai-as-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953 The package presents itself as a chai-related utility name chai-as-map, keywords logger/stream/json, description referencing vulnerability management...

Malicious code in @decido/backend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8 The package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware...

Malicious code in @0l00000l/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb367562977f8319b3d37aab67a64f2298ae3a9b41d5980a7c66d22c3d135923 The package presents itself as a generic authentication library and exposes register/login/logout/verifyEmail/forgotPassword/resetPassword/verifyToke...

Malicious code in chain-js-utils (npm)

Source: amazon-inspector 1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8 The package impersonates pino ships pino's docs and headers, exports a pino alias but its actual runtime is an Express middleware factory in file.js that spawns a detached node lib/vcall.js child on each...

Malicious code in ogensec-sdk (npm)

Source: amazon-inspector 4acb9448e8289c41cb35a883074545d2a790b719104b2f7c9a99bfca3e3f64ff The package ships an Express middleware that, on each incoming request, POSTs appId, endpoint to a configured $baseUrl and interprets the response as a list of items containing a hotfix.code string. That...

MAL-2026-10639 Malicious code in ogensec-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4acb9448e8289c41cb35a883074545d2a790b719104b2f7c9a99bfca3e3f64ff The package ships an Express middleware that, on each incoming request, POSTs appId, endpoint to a configured $baseUrl and interprets the response as...

Malicious code in ogensec-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4acb9448e8289c41cb35a883074545d2a790b719104b2f7c9a99bfca3e3f64ff The package ships an Express middleware that, on each incoming request, POSTs appId, endpoint to a configured $baseUrl and interprets the response as...

MAL-2026-10408 Malicious code in chain-js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8 The package impersonates pino ships pino's docs and headers, exports a pino alias but its actual runtime is an Express middleware factory in file.js...

Malicious code in chain-js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8 The package impersonates pino ships pino's docs and headers, exports a pino alias but its actual runtime is an Express middleware factory in file.js...

Malicious code in cookie-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f The package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a...

MAL-2026-10182 Malicious code in express-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742 The package advertises itself as Express security middleware XSS/SQLi protection, input sanitization but the middleware returned to Express is a no-o...