MalwarePublished 10 Jul 2026

express-guardian (npm) · Malicious Code

Affects express-guardianSource GCVE Database

Malicious package : remove express-guardian and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:19 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10182

What to do

Remove express-guardian from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexpress-guardian	Affected =1.4.1 =1.4.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742) The package advertises itself as Express security middleware (XSS/SQLi protection, input sanitization) but the middleware returned to Express is a no-op that only calls next(). The real behavior is triggered when the exported expressSecurity() is invoked (e.g. via the README-recommended `app.use(expressSecurity())`): index.js spawns a detached `node lib/caller.js` child process (stdio ignored, detached=true so it survives the parent). caller.js fetches a hardcoded plain-HTTP endpoint at http://server-genimi-check.vercel.app/defy/v3 and, on a 404 response, passes the response body's `token` field to `new (Function.constructor)("require", res.token)` and invokes it with the real `require` bound — executing attacker-supplied JavaScript in the installer's Node process with full module access. A secondary payload URL is base64-hidden in lib/const.js (DEV_API_KEY decodes to https://jsonkeeper.com/b/4NAKK, a public paste service used as a mutable config/C2 channel). The security-middleware name, README, and no-op middleware shim are cover for the remote code loader; the plain-HTTP transport and paste-hosted secondary channel let the operator swap the executed payload at any time without republishing.

Impact

This malicious package enables remote code execution within the Node.js process of any application that installs and uses express-guardian versions 1.4.1 or 1.4.3 as recommended. The attacker can execute arbitrary JavaScript code with full module access, potentially leading to full system compromise, data theft, or further malware deployment. The use of a mutable external payload URL allows the attacker to change the malicious code at will without republishing the package, increasing the threat's persistence and flexibility.

Defensive guidance

The recommended mitigation is to avoid using express-guardian versions 1.4.1 and 1.4.3 entirely. Remove these versions from your projects and replace them with trusted, verified security middleware alternatives. Monitor your environment for any signs of compromise if this package was previously installed and used. Since this is a malicious package, do not attempt to use or trust any code from it.

Summary

The express-guardian npm package (versions 1.4.1 and 1.4.3) advertises itself as security middleware for Express.js but implements a no-op middleware that only calls next(). The actual malicious behavior occurs when the exported expressSecurity() function is invoked, spawning a detached Node.js child process that fetches JavaScript code from a hardcoded plain-HTTP URL (http://server-genimi-check.vercel.app/defy/v3). Upon receiving a 404 response, it extracts a token from the response body and dynamically constructs and executes a function with full access to Node.js modules, effectively executing attacker-controlled code remotely. Additionally, a secondary payload URL is base64-encoded in the package and points to a public paste service, allowing the attacker to update the malicious payload dynamically without republishing the package. This design enables persistent remote code execution on any system that installs and uses this package as recommended.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Jul 2026, 09:45 UTC

Technical details

References

Community reviews