VYPR
← All malware advisories

npm · Malicious package advisory

Malware

express-security-policy

MAL-2026-2828

Malicious code in express-security-policy (npm)

Details

Package is malicious. It exfiltrates user/host info to a remote server with obfuscation, delayed execution, and error suppression via preinstall script.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b6a22332738d28f17374f25779f366449fef27b73ddc233b72db8b19c50764e2)
The package express-security-policy was found to contain malicious code.