0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
express-request-engine
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting express-request-engine, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-10414 | Unknown | Malicious code in express-request-engine (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30) The package's main entry (index.js) presents itself as a `normalize-path` utility but on module load calls initPlugin() at top level, which performs an HTTPS fetch to https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92 and passes the response body's `record.cerookie` field into `new (Function.constructor)('require',...)`, invoking it with the consumer's own `require` function. The result is arbitrary attacker-controlled JavaScript executin |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (650f45223a2abc34039d499274c1cce89abdf6b4be571d326b73e2b10da48e30) The package's main entry (index.js) presents itself as a `normalize-path` utility but on module load calls initPlugin() at top level, which performs an HTTPS fetch to https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92 and passes the response body's `record.cerookie` field into `new (Function.constructor)('require',...)`, invoking it with the consumer's own `require` function. The result is arbitrary attacker-controlled JavaScript executin