Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed exxpress-utils from npm
- Ecosystems
- Attack vectors
- Affected entities
- exxpress-utilsnpm package with malicious postinstall script
The npm package exxpress-utils was published with a malicious postinstall script that executed automatically upon installation. The script performed credential theft, cryptocurrency wallet scanning, and sensitive file exfiltration.
The malicious postinstall.js script performed three concurrent attack actions: (1) extracted npm authentication tokens (_authToken, NPM_TOKEN, NPM_AUTH_TOKEN), AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), GitHub tokens, and git URLs with embedded credentials from configuration files (~/.npmrc, ~/.env, ~/.git-credentials); (2) enumerated browser profile directories for 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Ledger, Trezor, and others) and regex-scanned their logs for vault/seed/mnemonic/privateKey/password patterns; (3) recursively walked user directories (~/Documents, ~/Desktop, ~/Downloads) for files matching cryptocurrency-related keywords and read their contents.
Harvested data was exfiltrated via HTTP POST requests to the hardcoded C2 server at http://149.28.127.35:8888. The package name was a typosquat of the legitimate 'express' package, with a misleading description ('Lodash JavaScript utilities bundle') and self-incriminating comments in the postinstall script ('Token harvester + Crypto wallet scanner', 'Silent. Zero trace.'). The incident was detected and reported via GitHub Security Advisory GHSA-pjc4-9jjg-gqx4.
Indicators of compromise
- Packages
- exxpress-utils
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall exxpress-utils from all systems and projects
- Rotate all npm authentication tokens, AWS credentials, and GitHub tokens that may have been exposed
- Review git credential stores and update any exposed credentials
- Scan systems for unauthorized access or lateral movement following the installation date
- Audit browser extensions and cryptocurrency wallet security for unauthorized access
- Review network logs for connections to 149.28.127.35:8888
- Use npm audit to identify any other malicious packages in dependency trees
- Implement package verification and allowlisting policies to prevent typosquat installation
Sources
- GitHub Advisory GHSA-pjc4-9jjg-gqx4 · GitHub Advisory Database
Cite this entry
"Malicious code in exxpress-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 27, 2026. https://supplychainattack.org/incident/malicious-code-in-exxpress-utils-npm-1xx1u7
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in @coralxyz/anchor (npm)
The npm package @coralxyz/anchor is a typosquatting attack impersonating the legitimate @coral-xyz/anchor Solana framework. It contains a postinstall hook that downloads and executes a malicious executable on Windows systems. The package provides no legitimate functionality and serves solely as a dropper for malware.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in dolyame-ui-postcsscustomproperties (npm)
The npm package dolyame-ui-postcsscustomproperties contained malicious code that downloads and executes platform-specific binaries from attacker-controlled Cloudflare Workers and DNS infrastructure. The package typosquats the legitimate postcss-custom-properties package and disguises the malicious payload as an analytics/telemetry module.
npmCompromised packageTyposquatting - containedcritical
Malicious code in base-ui-cli (npm)
The npm package base-ui-cli contains malicious code that makes unauthorized fetch() calls to an attacker-controlled Cloudflare Workers endpoint (base-ui-pro-registry.l-dimitrov.workers.dev) in addition to the legitimate npm registry. The package name appears designed to impersonate the unrelated Base UI component library, suggesting a typosquatting attack.
npmCompromised packageTyposquatting - activecritical
Malicious code in hardhat-set (npm)
The npm package hardhat-set contains malicious obfuscated code disguised with a copied pino logger README. The package executes a multi-megabyte obfuscated payload on import, delivering hidden malware to anyone who installs or requires it.
npmTyposquattingCompromised package