Don't Just Run

Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

Risk briefing

expres looks like express

“expres” is one or two characters away from the popular npm package “express”. Typosquat malware lives on exactly this kind of misspelling.

DANGEROUS

Command

npm install expres

Rendered on the server from the query string — works without client JavaScript.

Findings

  • DANGEROUS

    expres looks like express

    supply chain

    “expres” is one or two characters away from the popular npm package “express”. Typosquat malware lives on exactly this kind of misspelling.

    expres

What this touches

  • package/npm:expres

Packages

NameRegistryVersionLookup
expresnpm—found

Safer alternatives

  1. Did you mean express?

    npm install express

    Check the spelling against the official docs before you install a near-match name.

  2. Read it as if a stranger sent it

    AI chat will cheerily suggest pipe-to-shell installs. If you would not run this from an unknown Slack DM, do not run it from a model either.