Hostile 92% javascript Download

exprdd 5.2.2

Malicious preinstall script

“Fast, unopinionated, minimalist web framework”

Foreign repo claim with preinstall curl pipe to nodenpm preinstall executes replayed third-party code through Node stdin
SHA-2561f92ac18fff23fcdac8acf048a9b05bb03841e8fcacea120e8940e0311b6a5fe
URLhttps://registry.npmjs.org/exprdd/-/exprdd-5.2.2.tgz
MaleculeO₂(C₂S₄)H₅(Cm₁₇Db₇Os₃Po₃U)Md₃(In₅Pa₁₁)

Also flagged by osm (Typosquat of the legitimate Express web framework, part of the CHAOS Worm campaign. The package was published 2026-09-29 by npm user 'dirtyblanket' (disposable email [email protected]) and imperso…) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.