express-request-engine@3.6.3

Analysis

express-request-engine@3.6.3 is a combosquat of the "express" framework. When required, it fetches attacker-controlled code from hxxps://api[.]jsonbin[.]io/v3/b/6a4f5816f5f4af5e29762c92 and executes it via the Function constructor with full require() access, giving the attacker arbitrary code execution in the installer's Node.js process. The C2 endpoint is a jsonbin[.]io bin whose content the attacker can update at any time to serve different payloads.