Express-brute is an npm module that provides brute-force protection middleware for Express.js routes by rate limiting incoming requests. It increases the delay between requests using a fibonacci-like sequence, making it ideal for protecting login pages and APIs from automated attacks.