npm: 11 Malicious Packages Drop Simultaneously in Coordinated Attack
On August 11, 2026, 11 malicious npm packages were simultaneously disclosed, indicating a highly coordinated supply chain attack targeting the ecosystem.
Key findings
- 11 malicious npm packages were simultaneously disclosed on August 11, 2026.
- The coordinated drop included packages mimicking DeFi and blockchain development projects.
- Packages like
upshift-configandaugustdigital-sdkwere published just two days before disclosure, indicating fresh impersonations. - Extracted IOCs include
app.upshift.financeandaugustdigital.io, suggesting potential command-and-control or data exfiltration. - Affected systems should be considered fully compromised, requiring immediate credential rotation and thorough system audits.
On August 11, 2026, a highly coordinated supply chain attack unfolded on the npm ecosystem, with 11 malicious packages simultaneously disclosed at 00:00 UTC. This instantaneous reporting across multiple distinct packages strongly indicates a synchronized malicious campaign, rather than disparate, unrelated incidents. While the packages do not share a common naming prefix or scope, their unified disclosure time points to a single, deliberate push by an attacker or group aiming for maximum impact. The absence of a clear, overarching naming pattern suggests an attempt to diversify the attack surface and potentially evade detection mechanisms that might flag repetitive naming schemes.
The disclosed packages exhibit a notable thematic concentration around decentralized finance (DeFi) and blockchain-related projects, suggesting a targeted approach towards developers or users within this sector. Examples include camelot-ammv2-core, camelot-ammv2-periphery, @aerodrome-finance/contracts, @aerodrome-finance/slipstream, boring-vault, ethereum-vault-connector, and permit2. These names are designed to mimic legitimate libraries and components commonly used in the development of blockchain applications. Furthermore, two specific packages, upshift-config and augustdigital-sdk, were first published on August 9, 2026, just two days prior to their malicious disclosure. This extremely short lifespan from initial publication to being flagged as malicious is a strong indicator of fresh typosquatting or direct impersonation attempts, where attackers quickly register lookalike packages to capitalize on developer typos or trust in similar-sounding names. The package @telekom-ods/react-ui-kit stands out as an outlier in this thematic grouping, potentially indicating a broader, less targeted component within the same coordinated drop.
While specific behavioral findings detailing the exact malicious payloads were not publicly provided in the advisories, the extracted Indicators of Compromise (IOCs) offer crucial insights into the potential objectives of this campaign. Domains such as app.upshift.finance and augustdigital.io were identified, which directly correlate with the names of disclosed packages like upshift-finance and augustdigital-sdk. The presence of these domains strongly suggests that the malicious packages were designed to establish command-and-control (C2) communication channels or exfiltrate sensitive data to attacker-controlled infrastructure. Other IOCs like d9t67n4ijf9j5pmd6ug0sij3zd49twn1k.oast.online and d9t83osijf9n1gb62e4gxfioysijywqww.oast.me are typical patterns for out-of-band data exfiltration or callback mechanisms, often used to confirm successful infection or to relay stolen information.
The severity of such a supply chain compromise cannot be overstated. Any system that has installed one of these malicious npm packages should be considered fully compromised. The typical attack vectors associated with such packages include the theft of developer credentials, API keys, environment variables, and other sensitive data, as well as the potential for remote code execution on the compromised machine. The impact can extend beyond the immediate developer's workstation, potentially affecting build pipelines, deployment environments, and ultimately, end-user applications. Users are advised to assume the worst-case scenario and take immediate remediation steps to mitigate further damage.
Developers are urged to conduct a thorough audit of their project dependencies. Specifically, examine package-lock.json or yarn.lock files for any of the following package names:
@telekom-ods/react-ui-kitboring-vaultcamelot-ammv2-corecamelot-ammv2-peripherypermit2upshift-configupshift-financeaugustdigital-sdk@aerodrome-finance/contracts@aerodrome-finance/slipstreamethereum-vault-connector
If any of these packages are found, they must be immediately removed. Following removal, it is critical to rotate all potentially compromised credentials, including npm tokens, GitHub tokens, cloud provider API keys, and any other sensitive access keys. This rotation should be performed from a separate, secure machine to prevent further compromise. Additionally, review security logs for any unusual activity, such as unauthorized package publishes or suspicious network connections originating from affected systems.
This coordinated burst underscores the evolving sophistication of supply chain attacks. Attackers are increasingly employing tactics that combine rapid deployment with diverse naming strategies to maximize their reach and minimize the window for detection. The instantaneous nature of this disclosure event highlights the ongoing challenge for package ecosystems to identify and neutralize threats that are deployed in a highly synchronized manner. It serves as a stark reminder for developers to maintain vigilance, scrutinize new dependencies, and implement robust security practices throughout their development workflows.