Hostile 92% javascript Download

express-nodejs 5.2.1

Malicious preinstall script

“Fast, unopinionated, minimalist web framework”

Foreign repo claim with preinstall curl pipe to nodenpm preinstall executes replayed third-party code through Node stdin
SHA-256ba2665f50f0207f516b8764e1cc70e32017256d80af5cd6de34e8645c0293fe8
URLhttps://registry.npmjs.org/express-nodejs/-/express-nodejs-5.2.1.tgz
MaleculeO₂(C₂S₄)H₅(Cm₁₇Db₇Os₃Po₃U)Md₃(In₅Pa₁₁)

Also flagged by https://safedep.io/rss.xml (DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm), osv (MAL-2026-17243: Malicious code in express-nodejs (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.