npm: 10 Malicious Packages Disclosed in 15-Minute Coordinated Drop
On November 11, 2026, ten malicious npm packages were disclosed within a tight 15-minute window, indicating a coordinated takedown of newly published threats.
Key findings
- Ten malicious npm packages were disclosed within a 15-minute window on November 11, 2026.
- Many packages, including
chalks-logandprettlog, were published just hours before their disclosure. - All GHSA advisories for these packages were rated Critical.
- The rapid disclosure suggests a coordinated takedown effort by security teams.
On November 11, 2026, ten malicious packages were disclosed on the npm registry within a remarkably tight 15-minute window, from 03:52 UTC to 04:07 UTC. This rapid succession of advisories points to a coordinated takedown effort targeting newly introduced threats. A significant number of these packages, such as chalks-log, prettlog, termchalk, and kbmathlessons, were first published on the very same day they were flagged and removed, indicating they were fresh malicious drops intended for immediate impact. The swift disclosure highlights ongoing vigilance against new supply chain attacks.
While no single, clear naming pattern like a shared scope or prefix was immediately evident across all disclosed packages, the synchronized disclosure timing strongly suggests a common origin or detection event. Several package names appear to be generic utility-like names, such as chalks-log and prettlog, potentially aiming to blend in with legitimate logging or formatting libraries. Others, like kbmathlessons, seem more arbitrary. One package, @solana-trade/core, stands out as it was first published seven months prior, on April 1, 2026, suggesting a potential compromise of an older, albeit low-download, package, or a delayed detection of a long-standing threat. The majority, however, were newly minted for malicious purposes.
Specific behavioral findings were not detailed in the provided advisories for this burst. However, the consistent "Critical" severity assigned to all packages with GHSA advisories (e.g., GHSA-cm5x-2764-c8p9 for chalks-log, GHSA-7m86-chx9-8rr7 for prettlog) implies that these packages are designed to inflict significant harm. Typically, critical-severity malicious packages in npm can perform actions such as exfiltrating sensitive environment variables, installing additional malware, establishing persistent backdoors, or executing arbitrary commands on the compromised system. Users who installed these packages should assume a full system compromise.
The critical severity rating across all affected packages underscores the severe risk posed to any development environment or application that may have inadvertently incorporated them. This classification means that any computer that installed these malicious versions should be considered fully compromised. The standard recommendation in such scenarios is to immediately isolate affected systems, rotate all credentials and secrets from a separate, trusted machine, and conduct a thorough forensic analysis to understand the extent of the breach.
Developers are urged to audit their project dependencies immediately to identify any presence of these malicious packages. Specifically, check package-lock.json or yarn.lock files for entries matching the disclosed names. If any of the following packages are found, they should be removed, and a comprehensive security review initiated:
@solana-trade/corechalks-logtermchalkprettlogkbmathlessons
Furthermore, it is crucial to review npm token logs for any unauthorized publish events and to ensure all development environment secrets are rotated.
This burst of ten malicious npm packages, rapidly disclosed within a quarter-hour, illustrates the ongoing cat-and-mouse game in software supply chain security. While the lack of a clear naming convention might suggest a less sophisticated campaign or a collection of disparate threats caught simultaneously, the tight disclosure window points to either a highly effective automated detection system or a focused manual effort by security researchers or registry maintainers. Such rapid takedowns are vital in limiting the potential exposure and impact of newly introduced malicious code, emphasizing the need for continuous monitoring and swift response mechanisms within package ecosystems.