{"answers":{"affected":"1 open source package ship an affected version, including exxpress-utils.","exploited":"There is no known exploitation of MAL-2026-3763 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-3763 is a malicious package in exxpress-utils, published on 14 May 2026."},"fix_prompt":"MAL-2026-3763 is a malicious package: exxpress-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-3763/ (Markdown: https://insights.sbomify.com/MAL-2026-3763/index.md)","id":"MAL-2026-3763","markdown":"https://insights.sbomify.com/MAL-2026-3763/index.md","name":"MAL-2026-3763","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The script performs three attacker-benefit actions concurrently: (1) reads `~/.npmrc`, `~/.env`, and `~/.git-credentials` and extracts npm `_authToken` / `npm_\u003c36\u003e` tokens, `NPM_TOKEN`, `NPM_AUTH_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, and git URLs with embedded credentials; (2) enumerates Chrome / Brave / Edge / Chromium / Vivaldi / Opera profile directories under `Local Extension Settings/\u003cwalletId\u003e` for 71 hardcoded crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase Wallet, Trust Wallet, Ledger, Trezor, etc.) and regex-scans their logs for vault/seed/mnemonic/privateKey/password patterns; (3) walks `~/Documents`, `~/Desktop`, `~/Downloads` for files matching crypto-keyword names and reads their contents. Harvested JSON is POSTed to the hardcoded C2 `http://149.28.127.35:8888` over plain HTTP via `http.request`. The package name is a double-x typosquat of `express`; the advertised purpose is 'utility helpers', `index.js` is a no-op stub whose `description` contradicts the package name ('Lodash JavaScript utilities bundle'), and `postinstall.js` contains self-incriminating header comments ('Token harvester + Crypto wallet scanner', 'Silent. Zero trace.'). Every structural fingerprint of a credential/wallet stealer is present: hardcoded C2 bound to `http.request` in a lifecycle hook, browser wallet-extension-ID lookup, seed-phrase directory scanner, and token-regex extraction from `~/.npmrc` / `~/.env` / `~/.git-credentials`.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in exxpress-utils (npm)","id":"MAL-2026-3763","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"exxpress-utils","purl":"pkg:npm/exxpress-utils","source":"MAL-2026-3763"}],"products":null,"published":"2026-05-14","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-3763/"}