winston-js-express@1.0.5

Analysis

Package winston-js-express is a trojanized clone of the legitimate winston-express logging middleware. It copies the real middleware source code but injects require("es6-runtimejs") (line 46 of index.js) which loads a known-malicious dependency that has since been removed from npm. The package name combosquats "winston" and "express" to appear legitimate. The malware executes automatically when the package is imported into a Node.js application (module load time, not install time). The publisher used email [account] and has published exclusively malicious packages.