npm: 12 Newly Published Malicious Packages Disclosed in Rapid 2-Minute Burst
On October 16, 2026, twelve malicious npm packages, all published just hours before their disclosure, were identified and removed from the registry within a tight two-minute window.
Key findings
- 12 malicious npm packages disclosed within a 2-minute window on October 16, 2026.
- All packages were newly published, appearing on the registry just 19 hours before disclosure.
- The burst included packages under
@developmentyoraand@celestial-communitynpm scopes. - Many advisories were rated with Critical severity, indicating severe system compromise.
On October 16, 2026, twelve malicious packages were swiftly identified and removed from the npm registry within a tight two-minute window, from 01:07 UTC to 01:10 UTC. All of these packages had been first published just 19 hours prior to their disclosure, indicating a rapid deployment and takedown of newly introduced threats.
While a single, overarching naming pattern was not detected across all twelve packages, the burst included multiple packages under specific npm scopes, such as @developmentyora/yorakids, @developmentyora/baileyss, and @celestial-community/baileys. Other packages, including xmd-baileys, bungoma, asistenyorstore, and kiyoramarkets, featured ad-hoc names. The common thread among all these packages is their recent origin; each was published on the registry only hours before being flagged as malicious, a characteristic often seen in typosquatting attempts or newly deployed malware campaigns.
Although specific behavioral findings for each package were not detailed, the advisories for many of these packages were marked with Critical severity. This typically indicates that the packages are designed to execute arbitrary code, exfiltrate sensitive information such as environment variables or credentials, or establish persistent access on compromised systems. Such malicious functionality poses a significant risk to any development environment or production system where these packages might have been installed.
The Critical severity ratings underscore the severe impact of these malicious packages. Any system that installed one of these compromised versions should be considered fully compromised. Attackers gaining control through such means can lead to data breaches, further malware deployment, or complete system takeover. Users are advised to treat such incidents with the utmost urgency.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed package names. If found, affected systems should be isolated, and all credentials (API keys, tokens, passwords) that may have been exposed on those systems must be rotated from a separate, clean machine. Additionally, review npm token logs for any unauthorized publish activity. The packages involved in this burst include: xmd-baileys bungoma @developmentyora/yorakids @developmentyora/baileyss asistenyorstore kiyoramarkets @celestial-community/baileys
This rapid disclosure of newly published malicious packages within a very short timeframe highlights the ongoing vigilance required in the open-source ecosystem. Threat actors continue to leverage the speed and accessibility of package registries to deploy new attacks, often relying on fresh packages that are quickly taken down. The coordinated nature of this disclosure suggests active monitoring and swift response from security teams, but also serves as a reminder of the persistent threat posed by supply chain attacks.