Suspicious 80% javascript Download

express-javascript 5.2.2

Malicious preinstall curl pipe

“Fast, unopinionated, minimalist web framework”

curl command in preinstall scriptnpm package executes a high-risk install-time command
SHA-2561e8a638934741c47b8ae2ed025e477b2a03d0800f044b59ae148ffad1e71c260
URLhttps://registry.npmjs.org/express-javascript/-/express-javascript-5.2.2.tgz
MaleculeO(S₇)H₅(Cm₁₆Db₁₅Os₂Po₄U)Md₃(Pa₁₁In₅)

Also flagged by osm (Typosquat of the legitimate Express web framework, part of the CHAOS Worm campaign. The package was published 2026-09-29 by npm user 'dirtyblanket' (disposable email [email protected]) and imperso…) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.