Malicious Package

Overview express-session-timer is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of...

Malicious code in express-session-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f [email protected] schedules an unconditional destructive routine at module load time. Approximately 18 seconds after...

MAL-2026-16065 Malicious code in express-session-timer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 325e241839ca2d0861d19807df248bf7b06922533bccb441bbee521471f5d73f [email protected] schedules an unconditional destructive routine at module load time. Approximately 18 seconds after...

Malicious Package

Overview express-session-handler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

MAL-2026-14345 Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

Malicious Package

Overview express-session-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in express-session-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 076f813c0d0a60ee43f7a73f8aad609e5043cd8d92b57b5c3c3c08954accbb4f The package impersonates the popular express-session library by copying its name pattern, author metadata TJ Holowaychuk , and repository field...

MAL-2026-10131 Malicious code in express-session-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 076f813c0d0a60ee43f7a73f8aad609e5043cd8d92b57b5c3c3c08954accbb4f The package impersonates the popular express-session library by copying its name pattern, author metadata TJ Holowaychuk , and repository field...

Malicious Package

Overview express-session-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-40433

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278 Flowise - Session Hijacking via Weak Default Express Session Secret

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

CVE-2026-56278

Flowise before 3.1.0 (affected: 3.0.13 and earlier) uses a weak hardcoded default session secret ('flowise') for express-session when EXPRESS_SESSION_SECRET is not set (packages/server/src/enterprise/middleware/passport/index.ts). Because the secret is publicly visible in the source, an attacker ...

CVE-2026-56278: Use of Hard-coded Credentials

Flowise before 3.1.0 affected versions 3.0.13 and earlier uses a weak hardcoded default secret 'flowise' for the express-session middleware when the EXPRESSSESSIONSECRET environment variable is not set packages/server/src/enterprise/middleware/passport/index.ts. Because this default secret is...

Flowise: Weak Default Express Session Secret

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/middleware/passport/index.ts:55 | | Practical Exploitability | High | | Developer Approver | [email protected] | Description Express session secret has a weak default value...

GHSA-2QQC-P94C-HXWH Flowise: Weak Default Express Session Secret

Detection Method: Kolega.dev Deep Code Scan | Attribute | Value | |---|---| | Location | packages/server/src/enterprise/middleware/passport/index.ts:55 | | Practical Exploitability | High | | Developer Approver | [email protected] | Description Express session secret has a weak default value...