MSC-2026-12356

exxpress-utils 1.0.1 is a malicious npm package published by owner in.t.re.p.i.d.n.m.w. Its postinstall script node postinstall.js harvests npm auth tokens from /.npmrc, /.git-credentials, .env files NPMTOKEN, AWS keys and npm lines from /.bashhistory, plus hostname and username, and sends them b...

Malicious Package

Overview exxpress-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in exxpress-utils (npm)

Source: amazon-inspector dfa81f7c144d5feeea9c49254fbeec68f8271460d4a51efd5757a62b251c05f2 The package declares scripts.postinstall pointing at postinstall.js, which runs automatically on npm install. The script performs three attacker-benefit actions concurrently: 1 reads /.npmrc, /.env, and...

MAL-2026-3763 Malicious code in exxpress-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfa81f7c144d5feeea9c49254fbeec68f8271460d4a51efd5757a62b251c05f2 The package declares scripts.postinstall pointing at postinstall.js, which runs automatically on npm install. The script performs three...