Critical Malicious Code Vulnerability in expressjs-lint Package
Summary
MAL-2026-1106: Malicious code in expressjs-lint (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The expressjs-lint package is a tool designed for linting Express.js applications, helping developers maintain code quality and adhere to best practices. It is commonly used in Node.js environments to ensure that code is clean and free of common errors. However, this package has been compromised, leading to severe security implications for any system utilizing it.
Vulnerability Detail
The vulnerability stems from the presence of malicious code embedded within the expressjs-lint package. This code can fully compromise any computer that has the package installed, allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code has been confirmed by security researchers, and it poses a significant risk to the integrity and security of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall expressjs-lintIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than removing the package entirely. Ensure that you do not rely on expressjs-lint for linting your Express.js applications until a secure version is released.
Conclusion
The expressjs-lint package has been found to contain malicious code that poses a serious threat to any system using it. Immediate action is required to remove the package and secure any sensitive information. Stay vigilant and consider using tools like Vulert to monitor your applications for vulnerabilities.
See every vulnerability recorded for expressjs-lint →
FAQ
expressjs-lint is a linting tool for Express.js applications that helps developers maintain code quality.
If expressjs-lint is installed, your system may be fully compromised, allowing attackers to access sensitive information.
You should uninstall the package immediately and rotate any sensitive information stored on the affected system.
Currently, there is no patched version available. It is recommended to remove the package until further notice.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
