MAL-2026-12378 Malicious code in express-rate-controller (npm)
Malicious package
Published
MAL-2026-12378 is a malicious package: express-rate-controller (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-12378/ (Markdown: https://insights.sbomify.com/MAL-2026-12378/index.md)
- Package
- express-rate-controller
- Registry
- npm
What is MAL-2026-12378?
MAL-2026-12378 is a malicious package in express-rate-controller, published on 5 Aug 2026.
Official description
The package is published under the name express-rate-controller but describes itself as an SVG utilities library and ships a bin named svgcraft — the name, description, and CLI do not match. src/index.cjs exports getPlugin(), which issues an HTTPS GET to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data)(require), executing whatever JavaScript that endpoint returns with full require access. The loader is present only in the CommonJS build; index.mjs and index.d.ts do not declare getPlugin(), hiding the export from typed and ESM consumers. Any consumer that require()s the package and invokes getPlugin() — or downstream code that iterates the exported api object — runs attacker-controlled code delivered from api.avax-test.dev.
What should I do about MAL-2026-12378?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.