Threats Tagged 'mal-2026-7012'

The npm package express-mongo-limit is a malicious typosquatting package masquerading as a payload sanitization middleware. It executes a postinstall script that installs persistent malware including a clipboard hijacker that replaces cryptocurrency wallet addresses with attacker-controlled addresses, a spyware component that takes desktop screenshots every 2 seconds and emails them to the attacker, and an environment variable exfiltration backdoor. The malware achieves persistence by globally installing dependencies and registering a background service with pm2. The package was published by a malicious actor under the npm user jon_conway.