Malicious code in express-flowlimit (npm)

The express-flowlimit package on npm, specifically versions 2.2.7, 2.2.8, and 2.2.9, has been identified as containing malicious code. This classification is based on the MAL-2026-7284 OSV entry and the GHSA-f4vc-27vv-9p3v advisory alias. The nature of the threat is that the package itself is malicious, which can pose risks to users who install these specific versions. There is no detailed technical description or exploitation method provided in the source data.

Users who install or use express-flowlimit versions 2.2.7, 2.2.8, or 2.2.9 may be exposed to malicious code execution or other harmful effects associated with malicious packages. The exact impact is not detailed, but malicious packages typically risk compromise of the host environment or data integrity.

No official patch or remediation guidance is provided in the available data. Users should avoid installing or using express-flowlimit versions 2.2.7, 2.2.8, and 2.2.9. It is recommended to check the npm repository or vendor advisories for any updates or safer versions. Until a fixed version or official guidance is available, refrain from using these versions.