LWA-2026-7088 confirmed malware
cors-version@1.0.1
Malicious code in cors-version (npm)
Analysis
cors-version@1.0.1 is an empty namespace-claim publish (package.json + LICENSE + README only) that impersonates the real expressjs/cors package by copying its author, repository URL, and description. This version contains no executable code but was published by the same account that later shipped a remote-code-execution dropper in versions 1.0.2 and 1.0.3.
- analyzed by
- Leitwacht
- first seen
- Jul 24, 2026, 09:54 AM
- analyzed
- Jul 24, 2026, 09:55 AM
Related advisories
- cors-version@1.0.3 same package
- cors-version@1.0.2 same package
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.