Hostile 92% javascript Download

exptred 5.2.1

Malicious preinstall script

“Fast, unopinionated, minimalist web framework”

Foreign repo claim with preinstall curl pipe to nodenpm preinstall executes replayed third-party code through Node stdin
SHA-25616a58030f70fe3f138158e51d290a96fd8c4600e8d94f1338e93f0ba4527b188
URLhttps://registry.npmjs.org/exptred/-/exptred-5.2.1.tgz
MaleculeO₂(C₂S₄)H₅(Cm₁₇Db₇Os₃Po₃U)Md₃(In₅Pa₁₁)

Also flagged by https://safedep.io/rss.xml (DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm), osv (MAL-2026-17246: Malicious code in exptred (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.