MalwarePublished 26 Jun 2026Updated 9 Jul 2026

express-initial (npm) · Malicious Code

Affects express-initialSource GCVE Database

Malicious package : remove express-initial and rotate any secrets on hosts that installed it.

Data as of 11 Jul 2026, 09:43 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6543

What to do

Remove express-initial from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexpress-initial	Affected =12.1.9 =12.1.10	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8d292a4664135ed1869f907d62fb6472839ab54a59aedb2f3a88022a0c70095) package.json declares `"postinstall": "node index.js"`, so `npm install express-initial` automatically runs the package's main script. index.js is heavily obfuscated (obfuscator.io-style 317-entry RC4-encoded string array, base64 decoder, array-rotation self-shuffle, control-flow flattening) which hides the destination URL, AES key material, and command strings from any plain-text inspection. At runtime the script imports http/https, fs, path, os, crypto, and child_process, performs an HTTPS GET against a hard-coded remote host, splits the response on ':' into IV and ciphertext, decrypts via `crypto.createDecipheriv('aes-256-...', <sha256-derived key>, Buffer.from(iv,'base64'))`, writes the decrypted bytes into `path.join(os.tmpdir(), <name>)` with flag 'w+', and immediately invokes the dropped file via `child_process.exec`/`execFile` with `windowsHide: true`. This is a fetch-decrypt-and-execute dropper firing on default install. The package name also leverages the popular `express` framework while shipping empty author/description/repository metadata and a generic README that itself notes the script is obfuscated — consistent with a deliberate supply-chain lure rather than a legitimate helper. ## Source: ghsa-malware (7e5efd40dc0c1b6d6087636366132ffd18b77da665b9984fddb61c9bb72a80de) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Impact

Any system that installs or runs the affected versions of the 'express-initial' package is at high risk of full compromise. The malicious payload executes arbitrary code with the privileges of the installing user, potentially allowing attackers to control the system, steal secrets, and persist beyond package removal. Secrets and keys stored on the compromised system cannot be trusted and must be rotated from a secure environment. Removal of the package alone does not guarantee eradication of the malware or attacker persistence.

Defensive guidance

Immediate removal of the 'express-initial' package versions 12.1.9 and 12.1.10 is recommended. Systems with this package installed should be treated as fully compromised; all secrets and credentials stored on these systems must be rotated from a different, secure machine. Conduct a thorough incident response to identify and remediate any additional malware or persistence mechanisms. Avoid installing packages with suspicious or missing metadata and verify package authenticity before installation.

Summary

The 'express-initial' npm package (versions 12.1.9 and 12.1.10) includes a postinstall script that runs an obfuscated JavaScript file (index.js) upon installation. This script imports core Node.js modules and performs an HTTPS GET request to a hard-coded remote server to retrieve an encrypted payload. It decrypts this payload using AES-256 with a SHA-256 derived key and an initialization vector extracted from the response. The decrypted payload is saved to a temporary file and executed with hidden windows, enabling arbitrary code execution on the host. The package's empty author and repository metadata, combined with the obfuscated code, strongly indicate malicious intent designed to compromise systems via supply-chain infection.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Jul 2026, 00:23 UTC

Technical details

References

Community reviews