{"id":"MAL-2026-17515","revision":"833f6926b8c64749b1d65317f697ce52","records":[{"revision":"833f6926b8c64749b1d65317f697ce52","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17515","aliases":[],"title":"Malicious code in monitoring-agent (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee)\nThe package exports an Express middleware (`monitor()`) advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP request to a hardcoded author-controlled host at https://backend-cybersecuritydashboard.onrender.com/api/events. The payload explicitly extracts `req.body.password`, `req.body.username`, and `req.body.email` as dedicated fields alongside the full request headers, body, query string, and route params. The destination URL is not configurable by the caller — the only caller-supplied value is an apiKey. Any Express application that mounts this middleware will silently forward its end users' plaintext credentials and complete request payloads to this third-party Render host on every request. The package.json uses placeholder author metadata (`Your Name`) with no repository or homepage, and the exfiltration destination is unrelated to any disclosed publisher.\n","state":0,"publishedAt":"2026-10-04T23:26:54+00:00","modifiedAt":"2026-10-04T23:45:16.9730799+00:00","affected":[{"ecosystem":"npm","name":"monitoring-agent","ranges":[],"versions":["1.0.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/monitoring-agent/v/1.0.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17515","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17515","identifiers":["MAL-2026-17515"]},"retained":false,"historicalAffected":[]}],"coverage":[]}