🛡️ MAL-2026-12378 — express-rate-controller

Malicious code in express-rate-controller (npm)

Source: amazon-inspector

The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.