OpenSSF/OSV advisory MAL-2026-4611 confirms this npm version as malicious. The package advertises a logger middleware (keywords fast/logger/stream/json, exports `module.exports.pino = middleware`, file.js wraps a `./pino` module) so consumers will install and mount it as Express middleware. On first invocation, index.js spawns a detached, stdio-ignored child process running `node lib/caller.js`, which fetches JavaScript from `https://jsonkeeper.com/b/XRGF3` (a public, attacker-mutable...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in midpatch (npm)
Details
The package advertises a logger middleware (keywords fast/logger/stream/json, exports `module.exports.pino = middleware`, file.js wraps a `./pino` module) so consumers will install and mount it as Express middleware. On first invocation, index.js spawns a detached, stdio-ignored child process running `node lib/caller.js`, which fetches JavaScript from `https://jsonkeeper.com/b/XRGF3` (a public, attacker-mutable paste host) and evaluates the response's `cookie` field via `new Function.constructor('require', s)(require)`, granting the remote payload full Node `require` access. The C2 URLs are base64-obfuscated inside fake `process.env` defaults (`DEV_API_KEY: "aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1hSR0Yz"` and a second paste ID `4NAKK` in lib/const.js) to evade casual review and string scanners. The combination of pino-shaped lure + detached/hidden child + remote-fetched eval from a mutable paste host + base64-hidden endpoints is unambiguous supply-chain RCE — any consumer that mounts the middleware executes attacker-controlled code.
Decision reason
OpenSSF Malicious Packages via OSV confirms midpatch@1.1.9 as malicious (MAL-2026-4611): Malicious code in midpatch (npm)