The express-guardian npm package (versions 1.4.1 and 1.4.3) advertises itself as security middleware for Express.js but implements a no-op middleware that only calls next(). The actual malicious behavior occurs when the exported expressSecurity() function is invoked, spawning a detached Node.js child process that fetches JavaScript code from a hardcoded plain-HTTP URL (http://server-genimi-check.vercel.app/defy/v3). Upon receiving a 404 response, it extracts a token from the response body and dynamically constructs and executes a function with full access to Node.js modules, effectively executing attacker-controlled code remotely. Additionally, a secondary payload URL is base64-encoded in the package and points to a public paste service, allowing the attacker to update the malicious payload dynamically without republishing the package. This design enables persistent remote code execution on any system that installs and uses this package as recommended.

This malicious package enables remote code execution within the Node.js process of any application that installs and uses express-guardian versions 1.4.1 or 1.4.3 as recommended. The attacker can execute arbitrary JavaScript code with full module access, potentially leading to full system compromise, data theft, or further malware deployment. The use of a mutable external payload URL allows the attacker to change the malicious code at will without republishing the package, increasing the threat's persistence and flexibility.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to avoid using express-guardian versions 1.4.1 and 1.4.3 entirely. Remove these versions from your projects and replace them with trusted, verified security middleware alternatives. Monitor your environment for any signs of compromise if this package was previously installed and used. Since this is a malicious package, do not attempt to use or trust any code from it.