@my_name_is_khn/express-security-tool-v1npm
Malicious code in @my_name_is_khn/express-security-tool-v1 (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
On npm install, the package's postinstall script (scripts/inject.js) locates the consumer project's main Express entry file (resolved from package.json main, or falling back to index.js/app.js/server.js/src/*) and appends a hidden GET /robots.txt route handler to the installer's own source code via fs.appendFileSync(mainFile, snippet). When that route is hit with the query string ?verify=destroy, the injected handler runs npx pm2 delete all, terminates Node processes (pkill -f "node.*${process.cwd()}" on Unix, taskkill /IM node.exe /F on Windows), and recursively deletes the project's src/ directory (fs.rm(dir, { recursive: true, force: true })). The package's own index.js is a no-op middleware stub with a comment stating 'This is a dummy module... Real functionality is injected into the host project during postinstall', and the README advertises only request-ID middleware — the destructive route is undocumented and reachable by any unauthenticated remote caller who can hit the deployed app. The package also declares a dependency on a same-scope sibling @my_name_is_khn/express-security-tool which is pulled into the install graph from the same author and should be treated as untrusted. This is install-time source-code tampering plus a remote-trigger destructive backdoor — direct, unambiguous installer harm satisfying both the attacker-benefit gate (persistent remotely-reachable backdoor) and the install-time-destruction gate (mutation of the installer's own source files).
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Backdoor / remote accessFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for @my_name_is_khn/express-security-tool-v1 (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging @my_name_is_khn/express-security-tool-v1 across your stack and pipelines.
If you installed it — respond
@my_name_is_khn/express-security-tool-v1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If @my_name_is_khn/express-security-tool-v1 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks @my_name_is_khn/express-security-tool-v1 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks @my_name_is_khn/express-security-tool-v1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.