This package impersonates the popular Express web framework. It contains code that downloads and runs a Linux backdoor based on the CHAOS remote access tool, disguised as a system font service (systemd-fontd), which connects to a command-and-control server over Tor. The backdoor steals SSH private keys, npm tokens from .npmrc, known_hosts entries, system information and screenshots, and spreads to other hosts through SSH, AUR packages and stolen npm tokens.