Malicious Code Injection in express-fork Package
Summary
MAL-2026-17490: Malicious code in express-fork (npm). Affects express-fork versions 5.2.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The express-fork package is a typosquatted version of the widely used express package, which is a web application framework for Node.js. It is designed to simplify the process of building web applications and APIs by providing a robust set of features. However, express-fork has been identified as a malicious package that mimics express, leading unsuspecting developers to install it instead of the legitimate express package.
Vulnerability Detail
The vulnerability arises from a preinstall lifecycle script defined in the express-fork package's package.json file. This script executes a command that fetches a JavaScript file from a third-party source (gitflic.ru) via a web.archive.org wrapper and pipes it directly to the Node interpreter. This action occurs every time the package is installed, allowing the malicious code to run with the privileges of the installing user. The implications of this vulnerability are severe, as it can lead to credential theft, unauthorized access, and further payload delivery on the user's machine.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall express-forkIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, avoid installing packages that have similar names to well-known libraries. Always verify the package's authenticity by checking its repository and metadata before installation. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities.
Conclusion
The express-fork package poses a significant security risk due to its malicious code execution capabilities. Users are advised to uninstall this package and switch to the legitimate express package to safeguard their applications. Regular monitoring of dependencies using tools like Vulert can further enhance security.
See every vulnerability recorded for express-fork →
FAQ
A typosquatted package is a malicious package that mimics the name of a legitimate package, often with slight variations, to trick users into installing it.
You can check your package.json and package-lock.json files for any references to express-fork. Additionally, using tools like Vulert can help identify vulnerabilities in your dependencies.
Malicious packages can execute harmful code on your machine, leading to data breaches, unauthorized access, and potential damage to your system.
Vulert monitors your project for open-source vulnerabilities in real-time by analyzing your package-lock.json file, alerting you to any issues without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by vulnerabilities without needing to sign up.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
