Malicious Package

Overview express-ini is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

MAL-2026-10505 Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

EUVD-2025-113731

Malicious code in express-ini-soap-local npm...

MAL-2025-142379 Malicious code in express-ini-soap-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49eae2ca0c7684bc542e8a3126f14f9e1a4ab907103a7c6013ca9cd73841ec41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...