Malicious code in exxpress-tool (npm)
The npm package exxpress-tool (a one-character typosquat of express) contains malicious postinstall code that harvests npm tokens, git credentials, environment variables, and cryptocurrency wallet seeds from developer machines and CI environments, exfiltrating them to a hardcoded IP endpoint.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI environment installing exxpress-tool; potential exposure of npm tokens, git credentials, environment variables, crypto wallet seeds, and private keys.
- Ecosystems
- Attack vectors
- Affected entities
- exxpress-toolMalicious npm package; typosquat of express
The npm package exxpress-tool is a typosquat variant of the widely-used express package. Upon installation, a malicious postinstall.js script executes automatically, extracting sensitive credentials and secrets from the developer's environment.\n\nThe script harvests npm authentication tokens from ~/.npmrc, git credentials from ~/.git-credentials, and environment variables from ~/.env matching patterns for tokens, secrets, passwords, API keys, and cloud provider credentials (AWS, Azure, GCP, Stripe, Slack). It also collects system metadata including hostname and user information.\n\nAdditionally, the script targets cryptocurrency wallets by scanning Chrome/Brave/Edge extension directories for ~71 known wallet extension IDs (MetaMask, Phantom, Coinbase Wallet, Trust, Exodus, Ledger Live, Trezor, and others), extracting vault data, mnemonics, seeds, and private keys from LevelDB files. It recursively searches common user directories (Documents, Desktop, Downloads, OneDrive, Dropbox, Google Drive) for BIP-39 seed phrases and Ethereum private keys.\n\nAll harvested data is bundled as JSON and exfiltrated via HTTP POST to the hardcoded IP endpoint http://149.28.127.35:8888. The package's advertised library code is an empty stub; in-source comments confirm malicious intent: "The real payload is in postinstall.js", "Silent. Zero trace.", and "Token harvester + Crypto wallet scanner".
Indicators of compromise
- Packages
- exxpress-tool
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall exxpress-tool from all systems and CI/CD pipelines
- Rotate all npm authentication tokens and git credentials
- Review and rotate any AWS, Azure, GCP, Stripe, Slack, and other API keys that may have been exposed
- Regenerate or revoke any cryptocurrency wallet seeds and private keys if the system had wallet extensions installed
- Audit npm install logs and CI/CD logs to identify when exxpress-tool was installed and what systems were affected
- Consider the compromise of any secrets stored in environment variables or .env files as complete; rotate all such credentials
- Block the IP endpoint 149.28.127.35:8888 at network perimeter if possible
Sources
- GitHub Advisory GHSA-xfj5-439g-p6qm · GitHub Advisory Database
Cite this entry
"Malicious code in exxpress-tool (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-exxpress-tool-npm-1imbp7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package