exxpress-utils
This report shows the evidence for exxpress-utils@2.0.0. 4 of 4 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 4mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-3763 confirms this npm version as malicious.
Advisory
MAL-2026-3763
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in exxpress-utils (npm)
Details
The package declares `scripts.postinstall` pointing at `postinstall.js`, which runs automatically on `npm install`. The script performs three attacker-benefit actions concurrently: (1) reads `~/.npmrc`, `~/.env`, and `~/.git-credentials` and extracts npm `_authToken` / `npm_<36>` tokens, `NPM_TOKEN`, `NPM_AUTH_TOKEN`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, and git URLs with embedded credentials; (2) enumerates Chrome / Brave / Edge / Chromium / Vivaldi / Opera profile directories under `Local Extension Settings/<walletId>` for 71 hardcoded crypto-wallet extension IDs (MetaMask `nkbihfbeogaeaoehlefnkodbefgpgknn`, Phantom, Coinbase Wallet, Trust Wallet, Ledger, Trezor, etc.) and regex-scans their logs for vault/seed/mnemonic/privateKey/password patterns; (3) walks `~/Documents`, `~/Desktop`, `~/Downloads` for files matching crypto-keyword names and reads their contents. Harvested JSON is POSTed to the hardcoded C2 `http://149.28.127.35:8888` over plain HTTP via `http.request`. The package name is a double-x typosquat of `express`; the advertised purpose is 'utility helpers', `index.js` is a no-op stub whose `description` contradicts the package name ('Lodash JavaScript utilities bundle'), and `postinstall.js` contains self-incriminating header comments ('Token harvester + Crypto wallet scanner', 'Silent. Zero trace.'). Every structural fingerprint of a credential/wallet stealer is present: hardcoded C2 bound to `http.request` in a lifecycle hook, browser wallet-extension-ID lookup, seed-phrase directory scanner, and token-regex extraction from `~/.npmrc` / `~/.env` / `~/.git-credentials`.
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to exxpress-utils@2.0.0.
The same advisory and Firewall decision cover 4 recorded versions
1.0.2, 1.0.3, 1.0.5, 2.0.0
The versions list below shows the verdict for each recorded version.
- Avoid installing exxpress-utils@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.