# MAL-2026-10063: Malicious code in express-router-engine (npm)


- **Type:** Malicious package
- **Package:** `express-router-engine` (npm)
- **Published:** 9 Jul 2026

## What is MAL-2026-10063?

MAL-2026-10063 is a malicious package in express-router-engine, published on 9 Jul 2026. 

### Official description

The sole shipped file index.js is a heavily obfuscated (RC4 + base64 string-array, 337-entry rotated array, control-flow flattening) IIFE that executes at require() time. On load it constructs a URL from encrypted string constants plus the package version, issues an HTTP GET with an `Authentication` header, splits the response body on ':' to derive a symmetric key and IV, decrypts the payload with crypto.createDecipheriv, writes the decrypted bytes to a file under a temp/home path, and executes that file via child_process.exec with `windowsHide:true`. All module names (fs, os, path, child_process, http client), the fetch URL, header name/value, crypto algorithm, and temp path components are stored encrypted in the string array — the obfuscation exists purely to hide the C2 URL and payload pipeline. The package name (`express-router-engine`) also mismatches its own description text (`express-route-engine is a lightweight routing framework...`), consistent with name-confusion against a legitimate routing helper. Any consumer that requires this package fetches and executes attacker-controlled code on the installer's machine.

## What should I do about MAL-2026-10063?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10063 is a malicious package: express-router-engine (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10063/ (Markdown: https://insights.sbomify.com/MAL-2026-10063/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10063

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10063/
Summaries are generated and may contain mistakes; the official description above is the record.