Malicious code in express-bunker (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000) express-bunker@6.1.0 ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP (http://130.49.177.51:18080/p/dc-20260627-yandex-geobase) at npm install time, transmitting the package name, version, and a fixed campaign nonce (bb-express-bunker-20260628). The beacon fires unconditionally on every install with no opt-out. The package name and beacon path indicate a dependency-confusion squat against an internal namespace (yandex-geobase): any host or CI system that mis-resolves an internal dependency name to this public artifact silently signals successful name shadowing to the operator-controlled endpoint, disclosing installer environment information and confirming exploitability for follow-on attacks. A README self-label as a 'benign PoC' does not change the installer-side effect — the public artifact performs install-time outbound network I/O the installer did not opt into, and the same install vector could ship arbitrary code in a later version. ## Source: ghsa-malware (27082ec28738f103f3d79213fcec51b4d66b71e422642ca9d530b3d005858f52) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the co
MAL-2026-10500
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-10500
express-bunker
Source reference: /affected/0/package/name
- Affected versions
- 6.1.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "express-bunker",
"purl": "pkg:npm/express-bunker",
"ecosystem": "npm"
},
"versions": [
"6.1.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-bunker/MAL-2026-10500.json",
"indicators": {
"evidence_files": [
{
"path": "postinstall.js",
"tlsh": "cbe02bb859f190382ded41c9f3e2ac4bd5cb9141b155a080ee9a13a016d39932ba22b0",
"sha256": "b17a9b1247236ef5ce0163600747d387f2bde35a2180ee54f2b0d74df44512ff"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "3c4dc46aa5d350cc2ecb1959d40128bc90ddd9c9",
"sha512_sri": "sha512-jTFOPtQm/08nWP/D3StyVNvj+4GMG6vZx4vhqL6aepdSBNm4HspfXpe9Y6ktZYB83EFBsDz+m6E0CxSPxFO/XA=="
},
"filename": "express-bunker-6.1.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10882 · Revision 1
- Added to Heist Feed
- Publisher date