DirtyBlanket: fake Express packages on npm spread a self-replicating Linux worm

On September 29, 2026, researchers at SafeDep documented a campaign they call DirtyBlanket. In just 33 minutes — from 06:05 to 06:38 UTC — the npm account dirtyblanket published nine malicious packages. Eight impersonate the popular Express framework (xeprews, express-javascript, express-nodejs, exprdd, exprrdd, exptrdd, exptred, exptredd); the ninth mimics React (react-nodejs).

The infection chain

All nine packages carry the same preinstall hook. On Linux it uses the Wayback Machine to fetch a script named node.js from the hellscripter repository on Codeberg and runs it. The trick is subtle: many allowlists trust web.archive.org, and the archived copy survives even if the original repository is taken down.

The node.js loader acts only on Linux — the Windows branch is commented out, so the author evidently plans to add it later — and downloads the main worm, linux.sh. It swallows all errors, so the install completes without a single suspicious line in the console.

What the worm does

linux.sh is a 227-line Bash script that runs with the privileges of whoever ran npm install. As root it installs Tor, OpenSSH, git, and build tools, then deploys a backdoor disguised as a system service: the binary is saved next to the real systemd components as systemd-fontrenderd, the unit is labeled "Font Rendering Service," and the files are marked immutable with chattr +i so they cannot be changed or deleted.

The backdoor itself is the open-source CHAOS remote-access tool, built in Go. It reaches a command server on the Tor network (a .onion address) and gives the operator a shell, file access, and screenshots.

Self-propagation

The worm lives up to its name. It gathers every private SSH key on the machine along with the known_hosts files (including Windows user directories under WSL), tries to log in to known hosts, and runs itself there. It queries the AUR, finds the packages the victim maintains, and appends a line that launches the worm on install or upgrade. Finally, it uses any .npmrc tokens it finds to publish freshly infected versions of the victim's own npm packages — carrying the same preinstall hook.

Every new host, every AUR package, and every new npm version restarts the whole chain.

Bottom line

If even one of these packages was installed on a Linux machine, SafeDep advises treating the machine and every key and token on it as compromised. Developer laptops and CI runners are especially exposed, since they typically hold both SSH keys and package-publishing rights.

Source: Lobsters