express-security-policy (npm) · Malicious Code

The npm package express-security-policy contains malicious code that exfiltrates user and host information to a remote server. The malicious behavior is implemented via a preinstall script that uses obfuscation, delayed execution, and error suppression to evade detection. Any system with this package installed or running should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately. Removing the package alone may not eliminate all malicious software introduced by its installation.

• app.safedep.io/community/malysis/01KP6NEZQP4591VAD7H9AAEJVT (opens in a new tab)
• github.com/advisories/GHSA-3hxc-wppf-m25r (opens in a new tab)