Malicious Code Injection in exptrdd Package: A Critical Vulnerability
Summary
MAL-2026-17245: Malicious code in exptrdd (npm). Affects exptrdd versions 5.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The exptrdd package is a typosquatted version of the popular express package, often used in Node.js applications for building web servers and APIs. This package mimics express in its name, description, and metadata, making it easy for developers to mistakenly install it when they intend to use express. The malicious nature of exptrdd arises from its preinstall lifecycle script that fetches and executes code from an untrusted source, posing significant security risks.
Vulnerability Detail
The vulnerability in the exptrdd package originates from its preinstall script, which executes a command to download and run a script from a mutable branch on a remote server. This script runs with the privileges of the user installing the package, allowing it to perform arbitrary actions on the host system. The fact that the source is attacker-controlled means that the payload can change at any time, leading to potential data breaches, system compromise, or other malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall exptrddIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the exptrdd package and ensure that your package.json does not include it. Instead, use the express package directly to mitigate the risk of executing malicious code.
Conclusion
The exptrdd package poses a significant security risk due to its malicious preinstall script that can execute arbitrary code. Developers must ensure they are using the correct express package and monitor their projects for vulnerabilities to maintain security.
See every vulnerability recorded for exptrdd →
FAQ
A typosquatted package is a malicious package that mimics the name of a legitimate package, often leading developers to mistakenly install it due to typographical errors.
You can check your package.json file or run npm list exptrdd in your terminal to see if the package is installed in your project.
Using the exptrdd package can lead to arbitrary code execution on your system, data breaches, and potential compromise of your application and server.
There is no patch for the exptrdd package itself, as it is a malicious package. The best course of action is to uninstall it and use the legitimate express package.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time. You can check your application for vulnerabilities using the Vulert playground without any signup.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.