cors-updatenpm
Advisory published Updated
cors-update is a confirmed malicious npm package (MAL-2026-12174) that typosquats a legitimate package to trick installs (malicious versions 1.0.0, 1.0.1, 2.8.0…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in cors-update (npm)
What this malware does
Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin factory that issues an HTTPS GET to a hardcoded URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled (rejectUnauthorized: false) and passes the response body to new Function('require', data.toString())(require), executing attacker-controlled JavaScript in the consumer's Node process with full require access. Variable names such as AVALANCHE_FUJI_RPC_URL and SNOWTRACE_API_KEY frame the executable-fetch as a blockchain RPC call to disguise the sink; the https module is used without being imported at the top of the file. Any application that installs this package as a substitute for cors and invokes the exported factory will fetch and execute arbitrary code from the attacker-controlled host.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Search your lockfiles and build artifacts for cors-update (5 malicious versions).
If you installed it — respond
cors-update is a typosquat — you almost certainly intended a legitimately-named package. Remove cors-update, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If cors-update was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks cors-update-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.