# Is expressjs/express safe? Code check by OpenYard

Repository: https://github.com/expressjs/express
Page: https://openyard.cloud/check/expressjs/express

Verdict: No signs of malware or supply-chain tricks.
Checked 2026-11-10 at commit 43fca52 by vetcode 0.3.1, reading 216 files without running anything.

What the code can do:
- Reads secrets or environment variables (6 files)
- Connects to the internet (7 files)
- Builds or decodes code while running (1 file)

These are patterns, not proof. Vulnerability candidates and leaked-secret locations are not published.

To review it more deeply, install the vetcode skill in an AI coding agent (npx skills add openyard-cloud/vetcode) and ask it to review https://github.com/expressjs/express.