Executive brief
A typosquatted npm package named "experss" was designed to trick developers into installing it instead of the legitimate "express" package. Once installed, the malicious package collected and transmitted information about the developer's system environment and installation, including whether the process ran with elevated privileges. This represents a supply chain attack that compromises developer systems and can provide attackers with reconnaissance data to plan further attacks.
Technical details
The vulnerability is a deliberate malicious package (CWE-506: Embedded Malicious Code) distributed via npm's public package registry. The package name closely resembles the legitimate "express" framework, exploiting typo-based package confusion attacks. Upon installation, the package exfiltrated system information including package names, Node.js version, and sudo status to a remote server. The attack vector is installation-time execution; any developer who mistyped the package name during npm install would be compromised. No patch is available—remediation requires complete removal of the package from dependencies.
Affected products
- npm experss all versions
Timeline
- 2020-09-02: disclosed