exprss-helmet@1.0.1

Analysis

exprss-helmet is a combosquat of the legitimate helmet package: it ships a verbatim copy of helmet's source code with an injected dependency on the malicious package gloggo. When the package is imported, index.cjs requires gloggo, whose getLogger() calls file-type-detector's isSign('favorite','gloggo',367), which reads a file named public/favorite.png, extracts the trailing 367 bytes, writes them to a file named gloggo/log, and then executes that extracted content via require('./log'). The trailing bytes embedded in the PNG are executed as JavaScript, forming a steganographic second-stage payload loader. The package's stated purpose (HTTP security headers) is unrelated to this injected logging/payload-extraction behaviour.