🛡️ MAL-2026-12174 — cors-update

Malicious code in cors-update (npm)

Source: amazon-inspector

Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin factory that issues an HTTPS GET to a hardcoded URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data.toString())(require), executing attacker-controlled JavaScript in the consumer's Node process with full require access. Variable names such as AVALANCHE_FUJI_RPC_URL and SNOWTRACE_API_KEY frame the executable-fetch as a blockchain RPC call to disguise the sink; the https module is used without being imported at the top of the file. Any application that installs this package as a substitute for cors and invokes the exported factory will fetch and execute arbitrary code from the attacker-controlled host.