express-router-engine
express-route-engine is a lightweight routing framework built on top of Express.js that simplifies route management for enterprise Node.js applications. It provides automatic route loading, middleware composition, request validation, API versioning, and m
This report shows the evidence for express-router-engine@3.6.8. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package contains an unconditional import-time remote payload loader with dynamic code execution. Absence of npm lifecycle hooks does not mitigate runtime compromise of every consumer that imports it.
Decision evidence
public snapshot- `index.js` calls `initPlugin()` during module import.
- `index.js` requests `https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92`.
- `index.js` builds a `Function` from `JSON.parse(b).record.cerookie`.
- The fetched function receives `require`, enabling arbitrary local module access.
- `package.json` has no preinstall, install, or postinstall hook.
- No local credential harvesting, file writes, or agent-control configuration mutation was found.
Source & flagged code
0 flagged · loading sourceFindings
Affected versions and remediation
This report applies to express-router-engine@3.6.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing express-router-engine@3.6.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.