🛡️ MAL-2026-12376 — express-middle

Malicious code in express-middle (npm)

Source: amazon-inspector

package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle (obfuscator.io-style RC4-decoded 344-entry string array with control-flow flattening) whose runtime behavior assembles a destination host at runtime by concatenating four numeric fragments with '.' (an IPv4 built to hide the C2 from static review), performs an HTTPS request to that host, splits the response on ':' into IV and ciphertext, derives a key via pbkdf2, AES-decrypts the response with createDecipheriv, writes the plaintext payload to disk via fs.writeFileSync, and executes it through child_process.exec with windowsHide:true to suppress a console window. The package name resembles express middleware but ships no middleware functionality; the sole effect of installing it is remote code execution on the installer's machine under attacker control.