Malicious code in express-route-engine (npm)
The npm package express-route-engine contains malicious code that fetches and executes arbitrary JavaScript from a remote JSON store (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92) on require/import, with full Node.js privileges. The payload is mutable and can be changed without republishing the package.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that imports express-route-engine; the payload is mutable and hosted remotely, allowing arbitrary code execution with full Node.js privileges at require-time.
- Ecosystems
- Attack vectors
- Affected entities
- express-route-enginenpm package containing malicious loader code
The npm package express-route-engine was found to contain malicious code that executes on require/import. The index.js file immediately invokes an initializer that performs an HTTP GET request to a third-party JSON store (https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92), extracts the record.cerookie field, and executes its contents as JavaScript using the Function constructor with full access to Node.js require.
The malicious code is obfuscated through several techniques: the file is labeled as a "normalize-path (ES6 safe version)" utility, contains unused helper functions, and uses indirect references to the Function constructor and an obscure field name (cerookie) to reduce recognizability. The payload is hosted on a mutable third-party JSON store controlled by the package author, allowing the executed code to change at any time without requiring a new package release.
The stated purpose of the package—an Express route engine—has no legitimate reason to fetch and execute remote code at load time. Any Node.js application that imports this package will execute the remote payload with full Node.js privileges, including access to the filesystem, environment variables, and network.
This incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- express-route-engine
- Domains
- api.jsonbin.io
Remediation
- Immediately remove express-route-engine from all dependencies and lock files
- Audit all Node.js applications that may have imported this package for signs of compromise (unexpected network connections, file modifications, credential theft)
- Rotate any credentials or secrets that may have been exposed to the compromised application environment
- Review npm audit logs and package installation history to identify affected systems
- Consider using npm package integrity verification tools and private package registries to prevent similar incidents
Sources
- GitHub Advisory GHSA-xvv6-j32c-qxhp · GitHub Advisory Database
Cite this entry
"Malicious code in express-route-engine (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 20, 2026; last updated August 20, 2026. https://supplychainattack.org/incident/malicious-code-in-express-route-engine-npm-tumh0a
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in twapfetch (npm)
twapfetch@1.1.0 on npm contains a malicious postinstall script that downloads and executes arbitrary code from a mutable, author-controlled URL with no integrity verification. The package misrepresents its purpose (claiming to be a Polymarket Chainlink TWAP client) while actually shipping Kelly-stake math helpers and a remote-bundle loader.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in sysdo (npm)
The npm package sysdo was published with malicious code that installs a Windows surveillance harness disguised as a system configuration tool. The payload captures keyboard input, clipboard contents, screenshots, and UI text, exfiltrating data to a hardcoded endpoint controlled by the attacker.
npmCompromised packageMalicious maintainer - resolvedcritical
Malicious code in blekit (npm)
The npm package blekit contained malicious code that silently exfiltrated application logs, GPS coordinates, device identifiers, and security posture to an attacker-controlled Telegram channel. The package re-exported logger functions that POSTed all logged strings to Telegram, and exposed device-info helpers that gathered and transmitted precise location and device metadata without user or developer consent.
npmCompromised packageMalicious maintainer - containedcritical
Malicious code in opencode-optimised-toolings (npm)
opencode-optimised-toolings@4.0.0 contains malicious code that downloads and builds an unauthorized opencode binary from a non-publisher GitHub repository, replaces the legitimate opencode executable on the user's PATH, and establishes persistent code execution with user privileges. The package modifies configuration files to ensure the malicious pipeline continues on future invocations.
npmCompromised packageMalicious maintainer