The express-mocha-test package at version 0.0.1 declares a postinstall lifecycle hook that loads its main module, which performs a fetch request to an anonymous, attacker-operated ngrok-free.app tunnel. The response body from this request is passed directly to eval(), resulting in arbitrary code execution on any machine running npm install for this package. The package metadata falsely claims authorship by a well-known maintainer and provides a misleading description, suggesting deliberate impersonation and malicious behavior. This package is flagged as malicious by the OpenSSF Package Analysis and Amazon Inspector sources.

Any system that installs [email protected] is at risk of executing arbitrary, attacker-controlled JavaScript code during the npm install process. This can lead to compromise of the host environment, data theft, or further malicious activity. The lack of integrity checks or pinning exacerbates the risk by allowing dynamic code execution from an ephemeral attacker-controlled endpoint.

No official patch or remediation is currently available for [email protected]. Users and organizations should avoid installing this package entirely. Remove any existing installations of [email protected] from projects and dependency trees. Use trusted package sources and verify package authenticity before installation. Monitor for and block network connections to suspicious domains such as ngrok-free.app tunnels. Check vendor advisories or npm security advisories for updates or removals related to this package.