npm: 10 Newly Published Malicious Packages Dropped in Coordinated 2-Minute Disclosure

Key findings

Ten malicious npm packages were disclosed within a 2-minute window on August 28, 2026.
All packages were newly published on the same day they were disclosed as malicious.
All associated GitHub Security Advisories (GHSAs) rated the threats as 'Critical' severity.
Specific behavioral findings or Indicators of Compromise (IOCs) were not publicly detailed.
Packages like mfa-js, eip712-lite, and borsh-lite were part of this coordinated drop.

Coordinated Drop of 10 Malicious npm Packages

On August 28, 2026, a rapid and coordinated disclosure event saw ten malicious packages removed from the npm registry within a mere two-minute window. All of these packages, including mfa-js, ozturk-mfa, eip712-lite, borsh-lite, and clmm-fee-audit, were newly published on the very same day they were identified and flagged as malicious. This swift action, occurring between 18:17 UTC and 18:19 UTC, highlights an immediate response to a fresh wave of critical-severity threats targeting the JavaScript ecosystem. The packages, despite their short lifespan on the registry, posed a significant risk to any developer who might have inadvertently installed them.

Rapid Deployment and Takedown

A defining characteristic of this burst is the extremely short interval between the packages' initial publication and their subsequent disclosure. Every single one of the ten malicious packages was first published on the npm registry on August 28, 2026, just hours before their advisories were released. This pattern strongly suggests a strategy of rapid deployment, likely aiming to maximize exposure before detection. Unlike supply chain attacks involving the compromise of long-standing, popular packages, this event points to the creation and immediate distribution of new, malicious entities. While no overarching naming convention, such as a shared @scope/ or distinct prefix, was identified across all packages, the synchronized nature of their appearance and takedown points to a single, coordinated malicious operation. The packages involved include mfa-js (MAL-2026-15492, GHSA-2p92-fvvr-75hj), ozturk-mfa (MAL-2026-15493, GHSA-wrj4-48g5-vg88), eip712-lite (GHSA-p5jf-vqp6-95h5, MAL-2026-15491), borsh-lite (MAL-2026-15489, GHSA-6m7x-mwxq-f3wf), and clmm-fee-audit (MAL-2026-15490, GHSA-68fh-772h-wjfw). Each of these packages had minimal download counts, ranging from a few hundred to just over a thousand weekly downloads, consistent with their very recent publication.

Undisclosed Malicious Behavior

While specific behavioral findings from OpenSSF Package Analysis were not publicly detailed for this particular burst, the consistent "Critical" severity rating assigned to the GitHub Security Advisories (GHSAs) for these packages provides a strong indication of their potential impact. Critical-severity vulnerabilities or malicious packages typically possess capabilities that allow for severe compromise of a user's system. This can include, but is not limited to, remote code execution, exfiltration of sensitive environment variables (such as API keys, tokens, or cloud credentials), installation of backdoors, or the ability to modify system files. Without explicit behavioral reports, the exact mechanisms of compromise remain speculative, but the immediate and coordinated disclosure by security teams underscores the high confidence in their malicious intent and severe threat level. The rapid response suggests that these packages were designed to perform highly damaging actions upon execution.

Critical Severity and System Compromise

The "Critical" severity designation for all GHSA advisories in this burst means that any system that installed one of these packages should be considered thoroughly compromised. The implications of such a compromise are far-reaching: attackers could gain unauthorized access to development environments, build pipelines, or even production systems. This level of access could lead to further supply chain attacks, data breaches, or the deployment of additional malware. It is imperative that affected users understand the gravity of this situation. The standard recommendation for a critical compromise is to assume total loss of integrity and confidentiality for the affected system and its associated accounts.

Immediate Detection and Response Actions

Developers and organizations are urged to take immediate action to identify and mitigate potential exposure. The first step is to thoroughly audit all project dependencies. Specifically, check your package-lock.json or yarn.lock files for any of the package names identified in this burst. A representative list of these packages includes:

mfa-js
ozturk-mfa
eip712-lite
borsh-lite
clmm-fee-audit

If any of these packages are found, they must be promptly removed from all affected projects and environments. Following removal, a comprehensive security response is critical. This includes rotating all credentials, API keys, and tokens that may have been exposed or used on the compromised system. This rotation should ideally be performed from a separate, secure machine to prevent further compromise. Additionally, review npm audit logs and any internal security logs for signs of unauthorized activity, such as suspicious package publishes or unusual network connections originating from your build or development systems.

The Evolving Threat Landscape

This incident serves as a stark reminder of the persistent and evolving nature of software supply chain attacks. The coordinated, rapid deployment and takedown of these ten npm packages illustrate a dynamic cat-and-mouse game between attackers and security researchers. While the quick disclosure demonstrates the effectiveness of current monitoring systems, the continuous emergence of such threats underscores the need for proactive security measures. Developers must remain vigilant, scrutinize new dependencies, and integrate automated security scanning into their development workflows to help detect and prevent the next wave of malicious packages from impacting their projects. This type of attack, focusing on newly published packages, emphasizes that even low-download packages can pose a critical risk if they are part of a coordinated malicious campaign.