npm: 12 Malicious Packages Disclosed in 18-Minute Window
On October 20, 2026, twelve malicious packages were disclosed on the npm registry within a tight 18-minute window, indicating a coordinated malicious drop.
Key findings
- 12 malicious npm packages disclosed within an 18-minute window on October 20, 2026.
- Most packages were published hours before disclosure, indicating fresh malicious drops.
- All disclosed packages were assigned a 'Critical' severity rating.
- No clear common naming pattern or scope was identified across the packages.
On October 20, 2026, twelve malicious packages were disclosed on the npm registry within an 18-minute window, from 21:30 UTC to 21:48 UTC. All packages were newly published, with most appearing on the registry just hours before their disclosure, suggesting a rapid malicious campaign.
While no single overarching naming pattern or common scope was immediately apparent across all packages, their rapid publication and subsequent disclosure within such a short timeframe strongly suggest a coordinated effort. Many of these packages, such as animatecss-tailwind-bridge, tostpro, and tellyo-colours, were first published on the same day they were disclosed, indicating they were likely created specifically for this malicious campaign. Other packages like rs-lookout-sandbox-poc and rootaccessxvv-bbmarker were slightly older, published 5 and 3 days prior, respectively, but still very new.
Specific behavioral findings detailing the exact malicious actions of these packages were not provided in the advisories. However, the consistent 'Critical' severity assigned to nearly all disclosed packages indicates that they are designed to cause severe compromise to any system that installs them. Such compromises typically involve actions like arbitrary code execution, credential theft, or establishing persistence on the infected machine.
The consistent 'Critical' severity ratings across these advisories underscore the severe risk posed to developers. Installing any of these packages would likely lead to a full system compromise, necessitating immediate action. Users should consider any machine that installed these packages to be compromised and should rotate all sensitive credentials, such as API keys, tokens, and passwords, from a separate, secure machine.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of these malicious packages. If found, they should be removed, and all credentials associated with the compromised development environment should be rotated. Examples of packages to look for include:
animatecss-tailwind-bridgetellyo-colourstostpro@ziedzzz/demo-canaryrs-lookout-sandbox-poc@securihackbot/depconf-stage-1792484738
This burst of newly published malicious packages, rapidly disclosed within minutes of each other, highlights the ongoing challenge of supply chain security in package ecosystems. While the lack of a clear naming pattern makes it harder to attribute to a single, easily identifiable campaign, the tight coordination in their disclosure suggests a deliberate and organized effort to inject malicious code into the npm ecosystem. Such rapid drops often aim to maximize exposure before detection and removal.