express-guardian@1.4.1

Analysis

express-guardian is a combosquat package impersonating Express security middleware. When required, it spawns a detached child process that makes an HTTP GET request to hxxp://server-genimi-check[.]vercel[.]app/defy/v3 with a hardcoded authorization header. If the server responds with HTTP 404 and a JSON body containing a 'token' field, that token is executed as arbitrary JavaScript code via the Function constructor, granting the attacker full remote code execution on the installer's machine. The package's README fraudulently claims to provide SQL injection detection, XSS protection, and request sanitization — none of this functionality exists in the code. C2 endpoint: server-genimi-check[.]vercel[.]app, path /defy/v3.