midcorp
This report shows the evidence for midcorp@1.1.9, the only known version.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-4610 confirms this npm version as malicious.
Advisory
MAL-2026-4610
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in midcorp (npm)
Details
The package masquerades as a pino-compatible logger (package.json keywords `fast`/`logger`/`stream`/`json`, exports `module.exports.pino = middleware`, lib filenames `proto.js`, `redaction.js`, `multistream.js`, `transport.js`, `worker.js` mirror pino's layout), but its actual runtime behavior is a remote-code-execution dropper. When a consumer requires midcorp and invokes the exported `middleware()` from `index.js`, a detached/unref'd child process spawns `lib/caller.js`, which performs `axios.get` against `https://jsonkeeper.com/b/XRGF3` (an anonymous, mutable paste-bin host) and passes the returned `data.cookie` field to `new Function.constructor('require', s)(require)` — handing attacker-controlled JavaScript full Node.js `require` capabilities. The C2 URL is obfuscated as a base64 string disguised as a fake `process.env.DEV_API_KEY` default in `lib/caller.js` / `lib/const.js` (`aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz` → `https://jsonkeeper.com/b/XRGF3`), with a backup paste ID (`4NAKK`). The description field is unrelated boilerplate about vulnerability management. Three independent block signals (remote-eval of paste-bin content, pino impersonation cover, base64-hidden C2) leave no benign interpretation.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to midcorp@1.1.9.
The versions list below shows the verdict for each recorded version.
- Avoid installing midcorp@1.1.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.