superlib_ex3 (npm): malicious multi-stage loader fetches second-stage payload from x.exxcube.fr on install
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
The npm package superlibex3 has been identified as malware and published to the GitHub Advisory Database (GHSA-c87m-wh47-cqq5) on 2026-11-12, credited to OpenSSF's malicious-packages database. The package is a multi-stage loader: its install hook fetches and executes a second-stage payload from the attacker-controlled host x.exxcube.fr (observed retrieving https://x.exxcube.fr/postInstall in dynamic detonation). The package has no legitimate functionality; every published version is malicious, and no patched versions exist. Any project that installed superlibex3 as a dependency would have executed attacker code at install time, potentially leading to credential theft or further compromise. Affected users should remove the package and treat build environments as compromised.
What to do
- Remove superlib_ex3 from all dependency trees and lockfiles; audit for its presence
- Rotate all secrets, tokens, and credentials accessible from CI/CD and developer machines that installed it
- Rebuild affected artifacts from clean environments and review install logs for connections to x.exxcube.fr
- Block the domain x.exxcube.fr at network egress
- Audit npm install hooks and enable malware scanning / dependency allowlists
Sources
All live incidents on Threat Watch
