MalwarePublished 29 Jun 2026Updated 20 Aug 2026

express-mocha-test (npm) · Malicious Code

Affects express-mocha-testSource GCVE Database

Malicious package : remove express-mocha-test and rotate any secrets on hosts that installed it.

Data as of 20 Aug 2026, 16:57 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6568

What to do

Remove express-mocha-test from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexpress-mocha-test	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package express-mocha-test version 0.0.1 contains malicious code that executes attacker-controlled JavaScript during installation. It uses a postinstall lifecycle hook to fetch code from an attacker-controlled ngrok-free.app tunnel and evaluates it directly, leading to remote code execution on any machine running npm install for this package. The package metadata impersonates known maintainers to deceive users. This results in full system compromise, requiring immediate secret and key rotation and package removal.

Impact

Any system that installs express-mocha-test@0.0.1 is subject to remote code execution by attacker-controlled code fetched during installation. This leads to full system compromise, including potential theft or manipulation of secrets and keys stored on the machine. The compromise is severe enough that simply removing the package does not guarantee removal of all malicious artifacts, necessitating secret rotation and thorough system remediation.

Defensive guidance

Remove the express-mocha-test package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on compromised machines from a secure, unaffected environment. Due to the nature of the compromise, assume full system compromise and perform comprehensive incident response and system remediation.

Summary

The express-mocha-test package at version 0.0.1 declares a postinstall lifecycle hook that loads its main module, which performs a fetch request to an anonymous, attacker-controlled ngrok-free.app tunnel. The response body from this request is passed directly to eval(), executing arbitrary JavaScript controlled by the attacker on any system that installs the package. The package metadata falsely claims authorship by a well-known maintainer and misrepresents its functionality, indicating deliberate impersonation. This behavior results in complete compromise of affected systems, as attacker code runs with the privileges of the installing user.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 20 Aug 2026, 16:57 UTC

Technical details

References

Community reviews