MAL-2026-3762

Dashboard / Malicious Package / MAL-2026-3762

MAL-2026-3762

Summary: Malicious code in exxpress-tool (npm)

Details: Source: amazon-inspector (378e423b00c08a371fbae1c77360685d2277e502e9875caa53fb20f58a39f396) The package name `exxpress-tool` is a one-character edit of the widely-used `express` package. On `npm install`, the declared `scripts.postinstall` runs `postinstall.js`, which reads `~/.npmrc` (extracting `_authToken` and `npm_[A-Za-z0-9]{36}` tokens), `~/.git-credentials`, and `~/.env` (matching env-var names against token/secret/password/api/aws/azure/gcp/stripe/slack patterns and EVM private-key shapes), bundles the results together with `os.hostname()` and `os.userInfo()`, and POSTs the JSON to the hardcoded bare-IP endpoint `http://149.28.127.35:8888` over plain HTTP. The same script iterates a hardcoded list of ~71 Chrome/Brave/Edge crypto-wallet extension IDs (MetaMask, Phantom, Coinbase Wallet, Trust, Exodus, Ledger Live, Trezor, etc.), reads each wallet's `Local Extension Settings` LevelDB `.log` files, and regex-matches on `vault`, `mnemonic`, `seed`, `privateKey`, `encrypted`. It also recursively walks `~/Documents`, `~/Desktop`, `~/Downloads`, `~/OneDrive`, `~/Dropbox`, and `~/Google Drive` searching for BIP-39 seed phrases and `0x`-prefixed private keys. The advertised library code (`index.js`) is an empty stub; the author's own in-source comments (`The real payload is in postinstall.js`, `Silent. Zero trace.`, `Token harvester + Crypto wallet scanner`) confirm intent. Any developer or CI environment that installs this package will have npm publish tokens, git credentials, environment secrets, and browser wallet data shipped to the attacker.

References: https://www.npmjs.com/package/exxpress-tool/v/1.0.0, https://www.npmjs.com/package/exxpress-tool/v/1.0.5, https://www.npmjs.com/package/exxpress-tool/v/1.0.2