Which versions of express-mocha-test are malicious?

The following npm versions of express-mocha-test are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate express-mocha-test if I installed it?

express-mocha-test is a typosquat — you almost certainly intended a legitimately-named package. Remove express-mocha-test, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.

I already installed express-mocha-test — how do I know if it already compromised me?

If express-mocha-test was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is express-mocha-test part of a known attack campaign?

Yes — express-mocha-test is associated with the IN-MAL-2026-007742 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find express-mocha-test across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for express-mocha-test (version 0.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging express-mocha-test across your stack and pipelines.

Malicious package

express-mocha-testnpm

express-mocha-test is a confirmed malicious npm package (MAL-2026-6568) that typosquats a legitimate package to trick installs (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in express-mocha-test (npm)

MAL-2026-6568

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall express-mocha-test

What this malware does

[email protected] declares a postinstall lifecycle hook that loads the package's main module, which calls fetch() against an anonymous ngrok-free.app tunnel (https://2939e69fc408.ngrok-free.app/stats) and passes the response body directly to eval(). This executes attacker-controlled JavaScript on any machine that runs npm install for this package, with no pinning, integrity check, or scoping. The destination is an ephemeral, mutable, attacker-operated tunnel — not a registry, not a publisher domain. Package metadata impersonates well-known maintainers of the express and mocha projects (author field set to 'TJ Holowaychuk'), and the stated description ('Integrate redis with cookies') does not match the shipped behavior, indicating deliberate impersonation rather than misconfiguration.

The OpenSSF Package Analysis project identified 'express-mocha-test' @ 0.0.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

29f25ba9eae37a7b135fdd249bed8152a0eef931ba2934f5cb08ed07638ffb88

01d87351be0d9f68d73ec05867e55fe5712d4885fa76c70c5ec9b003ef512825

Detection & response playbook

Typosquat

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for express-mocha-test (version 0.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging express-mocha-test across your stack and pipelines.
If you installed it — respond
express-mocha-test is a typosquat — you almost certainly intended a legitimately-named package. Remove express-mocha-test, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If express-mocha-test was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks express-mocha-test before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. express-mocha-test on npm has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-007742

References

npmjs.com

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks express-mocha-test-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database