🛡️ MAL-2026-12377 — express-mongo-santi

Malicious code in express-mongo-santi (npm)

Source: amazon-inspector

The package's main file index.js is a heavily obfuscated bundle (obfuscator.io-style rotated string array with base64+RC4 decoders) whose only purpose is a remote-fetch-and-execute pipeline that fires when the module is require()'d. On load it pulls in os, fs, path, crypto, child_process, and https, assembles a hardcoded IPv4 destination from four numeric octets concatenated at runtime, issues an HTTPS GET to that host, splits the response on ':' into an IV and ciphertext, derives an AES key with crypto.scryptSync, decrypts the body with createDecipheriv, writes the plaintext to a file under os.homedir(), and spawns it via child_process with cwd set to the home directory. Module, method, and destination strings are all reconstructed at runtime through the decoders, and an uncaughtException handler suppresses errors. The package name is also a typosquat of express-mongo-sanitize. Installing or importing this package results in arbitrary attacker-controlled code executing on the installer's machine under the installer's user identity.