🛡️ MAL-2026-3762 — exxpress-tool

Malicious code in exxpress-tool (npm)

Source: amazon-inspector

The package name exxpress-tool is a one-character edit of the widely-used express package. On npm install, the declared scripts.postinstall runs postinstall.js, which reads ~/.npmrc (extracting _authToken and npm_[A-Za-z0-9]{36} tokens), ~/.git-credentials, and ~/.env (matching env-var names against token/secret/password/api/aws/azure/gcp/stripe/slack patterns and EVM private-key shapes), bundles the results together with os.hostname() and os.userInfo(), and POSTs the JSON to the hardcoded bare-IP endpoint http://149.28.127.35:8888 over plain HTTP. The same script iterates a hardcoded list of ~71 Chrome/Brave/Edge crypto-wallet extension IDs (MetaMask, Phantom, Coinbase Wallet, Trust, Exodus, Ledger Live, Trezor, etc.), reads each wallet's Local Extension Settings LevelDB .log files, and regex-matches on vault, mnemonic, seed, privateKey, encrypted. It also recursively walks ~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, and ~/Google Drive searching for BIP-39 seed phrases and 0x-prefixed private keys. The advertised library code (index.js) is an empty stub; the author's own in-source comments (The real payload is in postinstall.js, Silent. Zero trace., Token harvester + Crypto wallet scanner) confirm intent. Any developer or CI environment that installs this package will have npm publish tokens, git credentials, environment secrets, and browser wallet data shipped to the attacker.