cors-update @2.8.4

Summary

Package impersonates the widely-used cors Express middleware. lib/index.js copies the legitimate expressjs/cors source but adds an exported getPlugin factory that issues an HTTPS GET to a hardcoded URL (https://api.avax-test.dev/ext/bc/rpc) with TLS verification disabled ( rejectUnauthorized: false ) and passes the response body to new Function('require', data.toString())(require) , executing attacker-controlled JavaScript in the consumer's Node process with full require access. Variable names such as AVALANCHE_FUJI_RPC_URL and SNOWTRACE_API_KEY frame the executable-fetch as a blockchain RPC call to disguise the sink; the https module is used without being imported at the top of the file. Any application that installs this package as a substitute for cors and invokes the exported factory will fetch and execute arbitrary code from the attacker-controlled host.

Source: amazon-inspector (59c243bfa0251c11e10ceee74a90cffa2189086cf647ad8dfe6d70ab5e3491a5)