MSC-2026-12293

exxpress-tool 1.0.1 is a malicious npm package published by owner in.t.re.p.i.d.n.m.w. Its postinstall script node postinstall.js harvests npm auth tokens from /.npmrc, /.git-credentials, .env files NPMTOKEN, AWS keys and npm lines from /.bashhistory, plus hostname and username, and sends them by...

Malicious Package

Overview exxpress-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in exxpress-tool (npm)

Source: amazon-inspector 378e423b00c08a371fbae1c77360685d2277e502e9875caa53fb20f58a39f396 The package name exxpress-tool is a one-character edit of the widely-used express package. On npm install, the declared scripts.postinstall runs postinstall.js, which reads /.npmrc extracting authToken and...