github.com / expressjs

expressjs/express

JavaScript·214 files·commit 9a34acf·scanned 2h ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 69,472+ stars — findings likely false positives

verdict accurate?

69,472 stars

threat-state: lowlive

FINDINGS ░▒▓

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.test/res.redirect.js

      var app = express();
      var xss = 'javascript:eval(document.body.innerHTML=`<p>XSS</p>`);';
      var encodedXss = 'javascript:eval(document.body.innerHTML=%60%3Cp%3EXSS%3C/p%3E%60);';

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

infoAuthor has no other public repositoriesGitHub user "dependabot[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

142 files scanned @ 9a34acf | 9/25/2026 | heuristic scan — always review manually

risk by category

code execution10

network & exfiltration0

file system access0

obfuscation0

supply chain2

owasp / injection0

telemetry

files 142/214rules hit 3engine v6commit 9a34acf

github

expressjs/express

Fast, unopinionated, minimalist web framework for node.

JavaScript

69472

25063

6299d

214 files

142 scanned(66%)

9a34acf

architecture░▒▓

entry (1) flagged (1) pkg (43)

184 nodes · 213 edgesscroll to zoom · click node to jump to finding