MalwarePublished 7 Aug 2026

@decido/backend-core (npm) · Malicious Code

Affects @decido/backend-coreSource GCVE Database

Malicious package : remove @decido/backend-core and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 15:37 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13621

What to do

Remove @decido/backend-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@decido/backend-core	Affected 4.1.1 – 4.1.19 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The @decido/backend-core npm package contains hardcoded authentication tokens that bypass JWT verification. Specifically, the middleware accepts the literal strings 'mock-admin-token' and 'mock-token-123' as valid credentials, granting ADMIN and STUDENT access respectively without proper validation. This allows any client sending these tokens to gain unauthorized administrative or student-level access to applications using this middleware.

Impact

Applications using the affected versions of @decido/backend-core that integrate this middleware are vulnerable to unauthorized access. Attackers can gain administrative privileges or student-level access by supplying the known hardcoded tokens, bypassing all normal authentication and permission checks. This can lead to unauthorized user listing, role changes, and permission editing within the affected applications.

Defensive guidance

Until a fix is available, avoid using the affected versions of @decido/backend-core or remove/replace the vulnerable middleware that accepts hardcoded tokens. Do not deploy applications with this middleware in production environments.

Summary

The @decido/backend-core package exports Express middleware for authentication that short-circuits JWT verification when the Authorization header contains the hardcoded bearer tokens 'mock-admin-token' or 'mock-token-123'. These tokens bypass normal authentication checks and grant fixed ADMIN or STUDENT identities, respectively. Because these tokens are hardcoded and publicly known, any application using this middleware is vulnerable to unauthorized access by attackers who supply these tokens in HTTP requests.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Aug 2026, 15:37 UTC

Technical details

References

Community reviews