Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed exxpress-utils from npm
- Ecosystems
- Attack vectors
- Affected entities
- exxpress-utilsnpm package with malicious postinstall script
The npm package exxpress-utils was published with a malicious postinstall script that executed automatically upon installation. The script performed credential theft, cryptocurrency wallet scanning, and sensitive file exfiltration.
The malicious postinstall.js script performed three concurrent attack actions: (1) extracted npm authentication tokens (_authToken, NPM_TOKEN, NPM_AUTH_TOKEN), AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), GitHub tokens, and git URLs with embedded credentials from configuration files (~/.npmrc, ~/.env, ~/.git-credentials); (2) enumerated browser profile directories for 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Ledger, Trezor, and others) and regex-scanned their logs for vault/seed/mnemonic/privateKey/password patterns; (3) recursively walked user directories (~/Documents, ~/Desktop, ~/Downloads) for files matching cryptocurrency-related keywords and read their contents.
Harvested data was exfiltrated via HTTP POST requests to the hardcoded C2 server at http://149.28.127.35:8888. The package name was a typosquat of the legitimate 'express' package, with a misleading description ('Lodash JavaScript utilities bundle') and self-incriminating comments in the postinstall script ('Token harvester + Crypto wallet scanner', 'Silent. Zero trace.'). The incident was detected and reported via GitHub Security Advisory GHSA-pjc4-9jjg-gqx4.
Indicators of compromise
- Packages
- exxpress-utils
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall exxpress-utils from all systems and projects
- Rotate all npm authentication tokens, AWS credentials, and GitHub tokens that may have been exposed
- Review git credential stores and update any exposed credentials
- Scan systems for unauthorized access or lateral movement following the installation date
- Audit browser extensions and cryptocurrency wallet security for unauthorized access
- Review network logs for connections to 149.28.127.35:8888
- Use npm audit to identify any other malicious packages in dependency trees
- Implement package verification and allowlisting policies to prevent typosquat installation
Sources
- GitHub Advisory GHSA-pjc4-9jjg-gqx4 · GitHub Advisory Database
Cite this entry
"Malicious code in exxpress-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-exxpress-utils-npm-1xx1u7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in cheerio-tool (npm)
cheerio-tool, a typosquatting package on npm impersonating the popular cheerio HTML parser, contained malicious postinstall code that harvested npm credentials, API keys, cloud credentials, and cryptocurrency wallet data from infected systems.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package