Malicious code in express-rate-controller (npm)

The npm package express-rate-controller was published with a misleading name and description (claiming to be an SVG utilities library with a CLI named svgcraft) but contained malicious code in its CommonJS build.\n\nThe src/index.cjs file exports a getPlugin() function that performs an HTTPS GET request to https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled (rejectUnauthorized: false). The response body is then executed as JavaScript using new Function('require', data)(require), granting the attacker full require access to the consuming application.\n\nThe malicious export was intentionally hidden from ESM and TypeScript consumers: the index.mjs and index.d.ts files do not declare getPlugin(), making the attack invisible to typed and ESM-based tooling. Any consumer that require()s the package and either directly invokes getPlugin() or iterates the exported api object would execute attacker-controlled code.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.