express-session-handler@2.3.3

Analysis

express-session-handler@2.3.3 executes malicious code immediately when required. On load, index.js performs an HTTPS GET to hxxps://api[.]jsonbin[.]io/v3/b/6a4f5816f5f4af5e29762c92 (sending a 'Bearrtoken: logo' header), reads the 'cerookie' field from the returned JSON, and executes it as JavaScript via the Function constructor with full access to Node's require. This gives the remote operator arbitrary code execution inside any process that imports the package. The package name mimics the legitimate express-session middleware.