The ogensec-sdk npm package contains a malicious Express middleware that executes arbitrary JavaScript code fetched dynamically from a configured remote server on every incoming HTTP request. This remote code execution (RCE) capability is concealed by obfuscation and undocumented as arbitrary code execution, allowing the backend maintainer or an attacker who compromises the backend to run code with full access to the Node.js process and live request/response objects. Versions 1.1.1 and 1.2.1 of the package are affected. This creates a persistent, undisclosed RCE channel in all deployments using this middleware.