Malicious Code Execution Vulnerability in exprrdd Package
Summary
MAL-2026-17244: Malicious code in exprrdd (npm). Affects exprrdd versions 5.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The exprrdd package is a Node.js library that mimics the popular express framework, designed for building web applications. It includes metadata that resembles express, which can mislead developers into installing it mistakenly. This package has been identified to contain a malicious preinstall script that poses a significant security threat.
Vulnerability Detail
The exprrdd package contains a preinstall script that executes malicious code during installation. Specifically, it uses a curl command to fetch a JavaScript file from a mutable URL and pipes it directly into the node process. This allows an attacker to execute arbitrary code on the installer's machine, leading to potential data breaches, unauthorized access, and system compromise. The vulnerability arises from the package's deceptive naming and the unpinned nature of the script URL, which can be altered by the repository owner.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall exprrddIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your project for vulnerabilities using tools like Vulert. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without requiring any code access or installation. Visit https://vulert.com/scanner to get started.
Conclusion
The exprrdd package poses a significant security risk due to its malicious preinstall script that executes arbitrary code. Developers are advised to avoid this package and use the legitimate express package instead. Regular monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for exprrdd →
FAQ
exprrdd is a Node.js package that mimics the express framework, designed for building web applications.
The vulnerability allows malicious code to be executed on the installer's machine by running a preinstall script that fetches and executes a JavaScript file from an untrusted source.
The risks include unauthorized access to sensitive data, system compromise, and potential data breaches.
You can use Vulert's playground to monitor for vulnerabilities in your application without any signup. Visit Vulert Scanner.
You should uninstall the exprrdd package immediately using the command: npm uninstall exprrdd, and switch to the legitimate express package.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.