MalwarePublished 9 Jul 2026

express-router-engine (npm) · Malicious Code

Affects express-router-engineSource GCVE Database

Malicious package : remove express-router-engine and rotate any secrets on hosts that installed it.

Data as of 10 Jul 2026, 09:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10063

What to do

Remove express-router-engine from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmexpress-router-engine	Affected 3.6.5 – 3.6.8 4 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'express-router-engine' versions 3.6.5 through 3.6.8 contains malicious code that executes attacker-controlled payloads on the host machine. The package is heavily obfuscated to hide a command-and-control (C2) communication mechanism that downloads and runs encrypted code upon being required. The package name and description are inconsistent, indicating an attempt to masquerade as a legitimate routing framework. Any user installing or requiring this package risks executing arbitrary malicious code.

Impact

Any system that installs or requires the affected versions of 'express-router-engine' will execute attacker-controlled code, leading to a full compromise of the host environment. The malicious payload is fetched dynamically from a remote server, allowing the attacker to change or update the payload at will. This can lead to data theft, system manipulation, or further malware deployment. There is no indication that this is limited to specific environments or targets.

Defensive guidance

Users and organizations should immediately avoid installing or requiring 'express-router-engine' versions 3.6.5, 3.6.6, 3.6.7, and 3.6.8. Remove these versions from existing projects and replace them with trusted, verified packages. Monitor dependency trees for this package and audit for any signs of compromise. Since this is a malicious package, the best mitigation is to avoid its use entirely.

Summary

The 'express-router-engine' npm package (versions 3.6.5 to 3.6.8) contains a single obfuscated JavaScript file that executes immediately upon require(). This code constructs a URL from encrypted constants and the package version, then sends an HTTP GET request with an Authentication header to a remote server. The response is parsed to obtain a symmetric key and IV, which are used to decrypt a payload. The decrypted payload is written to a temporary file and executed via child_process.exec with hidden windows. The obfuscation hides all critical strings including module names, URLs, headers, crypto algorithms, and file paths. The package name and description mismatch suggests it is a typosquatting or name-confusion attack to trick users into installing it instead of a legitimate routing helper. This results in arbitrary code execution on any machine that requires this package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 10 Jul 2026, 09:52 UTC

Technical details

References

Community reviews