npm: 10 Malicious Packages Drop in 7-Minute Burst
On November 2, 2026, ten malicious npm packages were disclosed within a tight seven-minute window, indicating a coordinated effort to distribute harmful code.
Key findings
- Ten malicious npm packages were disclosed on November 2, 2026.
- All advisories were published within a tight seven-minute window.
- Packages were first published around 2.5 years ago, suggesting older compromises or dormant threats.
- No clear naming pattern or campaign signature was identified across the packages.
- Several suspicious domains were extracted, indicating potential C2 communication.
- Despite low download counts, the coordinated nature suggests an organized attack.
On November 2, 2026, ten malicious packages were disclosed on the npm registry within a remarkably tight seven-minute window, suggesting a coordinated takedown of compromised or dormant malicious code. These packages, despite their recent disclosure, were first published on the registry approximately 2.5 years ago, between April and July 2024. With current download counts ranging from 3 to 62 per week, these packages do not represent high-profile compromises of widely used libraries, but rather indicate either long-standing malicious presence in less-trafficked corners of the ecosystem or older packages that have recently been compromised and weaponized.
Unlike many coordinated campaigns that rely on clear naming patterns or shared scopes, this burst of malicious npm packages lacks an obvious signature. The package names appear disparate, ranging from dependent-final and maila-talijah-alpha-128 to more whimsical names like dian-peyek23-miaww, peas-tea-curut, and quiche-tea-curut. This suggests either ad-hoc typosquatting attempts without a central theme or a strategy to evade detection by avoiding predictable naming conventions.
While specific behavioral findings for these packages were not detailed in the advisories, the presence of several suspicious domains extracted from the package analysis suggests attempts at external communication or data exfiltration. These domains include auto.js, autochange2.js, autopublish2.js, autopublish3.js, loop.js, and test.js. Such domains are commonly associated with command-and-control infrastructure or data staging servers, indicating that the malicious packages likely intended to establish contact with an attacker-controlled endpoint.
The disclosure of these malicious packages, regardless of their specific payload, carries significant risk. Any system that installed one of these compromised versions should be considered potentially compromised. Malicious packages often aim to steal credentials, inject backdoors, or exfiltrate sensitive data, leading to full system compromise. Users are strongly advised to treat any affected environment as hostile.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, affected versions must be removed, and all credentials associated with the compromised environment should be rotated from a separate, secure machine. It is also prudent to review npm token logs for any unauthorized publishing activity. The affected package names include:
related_blackbird-toolteadevunemployed_xerinae-toolteadevpearx93qja-notthedevsdependent-finallow_hummingbird_replicate_automationdian-peyek23-miawwmaila-talijah-alpha-128peas-tea-curutquiche-tea-curutwet_rat_replicate_automation
This burst highlights the persistent threat of supply chain attacks, even through less-trafficked or older packages. While the immediate impact of these low-download packages might seem minimal, their coordinated disclosure within a short timeframe suggests an organized effort. Such incidents underscore the need for continuous vigilance and robust security practices in the software supply chain, as attackers constantly seek new vectors to compromise development environments.