express-mocha-test@0.0.1

Analysis

express-mocha-test is a combosquat package impersonating the Express and Mocha project names. The postinstall hook (scripts/postinstall.cjs) calls an onInstall() function in index.cjs. This function fetches code from hxxps://2939e69fc408[.]ngrok-free[.]app/stats and executes it immediately via eval(), making it a second-stage payload downloader. The attacker can serve arbitrary malicious code from that endpoint on every install. The package has no functional relationship to its name or its stated description ("Integrate redis with cookies").