CRITICAL npm Malware
Malicious code in superlib_ex3 (npm)
MAL-2026-19149
Published · Modified
Dependency scanning
Check whether superlib_ex3 is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
Malicious package. superlib_ex3 is a multi-stage loader: on install it fetches and executes a second-stage payload from the attacker-controlled host x.exxcube.fr (the install hook was observed in dynamic detonation retrieving https://x.exxcube.fr/postInstall). No legitimate functionality; all published versions are malicious. Full indicators at the reference below.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes