{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "334027796517f1c120034fc14f8367b6b072c273e591a33c88f82d1bb3859585",
              "tlsh": "df32138b16fb1531067ba06d573790227d66fd0b3098c954ffbcc7a81f428a9c9e1ab4"
            }
          ],
          "package_integrity": [
            {
              "filename": "backend-core-4.1.18.tgz",
              "hashes": {
                "sha1": "eeb7ebc95ee44838749bbf899d098d7b9283b486",
                "sha512_sri": "sha512-hNrawKoK06NhsUHhdqHVO2FhhMBmNQbZuVC9SWZpj3LFZYUJmH4yVHySfYbczRGK4IdJaeKeSxRQY3AeTkzN8w=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@decido/backend-core"
      },
      "versions": [
        "4.1.18",
        "4.1.1",
        "4.1.19",
        "4.1.12"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017124",
        "import_time": "2026-08-07T17:23:17.307260926Z",
        "modified_time": "2026-08-07T17:21:27Z",
        "sha256": "0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8",
        "source": "amazon-inspector",
        "versions": [
          "4.1.18"
        ]
      },
      {
        "id": "IN-MAL-2026-017122",
        "import_time": "2026-08-07T17:23:17.108789142Z",
        "modified_time": "2026-08-07T17:21:09Z",
        "sha256": "9e7107b1a6fae7149ef860c16211be97cd9ac2c4f902501a3bf1aca6ca3c3837",
        "source": "amazon-inspector",
        "versions": [
          "4.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-017121",
        "import_time": "2026-08-07T17:23:16.962716406Z",
        "modified_time": "2026-08-07T17:20:59Z",
        "sha256": "22054cd222daafe38b79055e1318d3ee7b1e669a8985fd6c6abe813ec60af5e6",
        "source": "amazon-inspector",
        "versions": [
          "4.1.19"
        ]
      },
      {
        "id": "IN-MAL-2026-017123",
        "import_time": "2026-08-07T17:23:17.212928381Z",
        "modified_time": "2026-08-07T17:21:16Z",
        "sha256": "38ea34937f7b568c68b947cf5d4636a3b3cd0fe3e6f9cc0a10e685465e2e5e8d",
        "source": "amazon-inspector",
        "versions": [
          "4.1.12"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0dfd7199d6ce265ba7ddfc699d99272411cfd63c955ea3f194d41701b5a885e8)\nThe package exports createAuthMiddleware / createAuthRouter for use as Express authentication middleware in downstream applications. The middleware short-circuits JWT verification when the incoming Authorization header bearer value equals the literal string \u0027mock-admin-token\u0027, returning a synthesized ADMIN user and calling next() without any further validation. A second literal \u0027mock-token-123\u0027 grants a STUDENT identity on the same code path. Any deployment that wires this middleware into its Express app accepts these fixed strings as valid credentials, so any HTTP client that sends \u0027Authorization: Bearer mock-admin-token\u0027 passes requirePermission checks that gate administrative routes (user listing, role changes, permission editing). The tokens are hardcoded in published code and are effectively universal admin credentials known to anyone who inspects the package.\n",
  "id": "MAL-2026-13621",
  "modified": "2026-08-07T17:25:00Z",
  "published": "2026-08-07T17:20:59Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@decido/backend-core/v/4.1.18"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@decido/backend-core/v/4.1.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@decido/backend-core/v/4.1.19"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@decido/backend-core/v/4.1.12"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @decido/backend-core (npm)"
}