Skip to content
Heist/ feed
Unrated

Malicious code in express-bunker (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000) express-bunker@6.1.0 ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP (http://130.49.177.51:18080/p/dc-20260627-yandex-geobase) at npm install time, transmitting the package name, version, and a fixed campaign nonce (bb-express-bunker-20260628). The beacon fires unconditionally on every install with no opt-out. The package name and beacon path indicate a dependency-confusion squat against an internal namespace (yandex-geobase): any host or CI system that mis-resolves an internal dependency name to this public artifact silently signals successful name shadowing to the operator-controlled endpoint, disclosing installer environment information and confirming exploitability for follow-on attacks. A README self-label as a 'benign PoC' does not change the installer-side effect — the public artifact performs install-time outbound network I/O the installer did not opt into, and the same install vector could ship arbitrary code in a later version. ## Source: ghsa-malware (27082ec28738f103f3d79213fcec51b4d66b71e422642ca9d530b3d005858f52) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the co

Announced Source revision 1
Original source ↗

MAL-2026-10500

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-10500

express-bunker

Source reference: /affected/0/package/name

Affected versions
6.1.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "express-bunker",
      "purl": "pkg:npm/express-bunker",
      "ecosystem": "npm"
    },
    "versions": [
      "6.1.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-bunker/MAL-2026-10500.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "postinstall.js",
            "tlsh": "cbe02bb859f190382ded41c9f3e2ac4bd5cb9141b155a080ee9a13a016d39932ba22b0",
            "sha256": "b17a9b1247236ef5ce0163600747d387f2bde35a2180ee54f2b0d74df44512ff"
          }
        ],
        "package_integrity": [
          {
            "hashes": {
              "sha1": "3c4dc46aa5d350cc2ecb1959d40128bc90ddd9c9",
              "sha512_sri": "sha512-jTFOPtQm/08nWP/D3StyVNvj+4GMG6vZx4vhqL6aepdSBNm4HspfXpe9Y6ktZYB83EFBsDz+m6E0CxSPxFO/XA=="
            },
            "filename": "express-bunker-6.1.0.tgz"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#10882 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement