npm: 13 Malicious Packages Disclosed in Coordinated 22-Minute Drop
On August 17, 2026, 13 malicious npm packages were disclosed within a tight 22-minute window, indicating a coordinated supply chain attack.
Key findings
- 13 malicious npm packages were disclosed on August 17, 2026.
- All advisories were published within a tight 22-minute window.
- All identified packages were newly published on the same day as their disclosure.
- Multiple packages, including
bcs-coreandleb128x, were flagged with Critical severity. - No clear naming pattern or campaign signature was identified beyond the tight disclosure window.
On August 17, 2026, a coordinated disclosure event saw 13 malicious packages removed from the npm registry within a tight 22-minute window. This rapid succession of advisories, all published between 16:02 UTC and 16:24 UTC, points to a deliberate and synchronized attack targeting the software supply chain. A notable characteristic of this burst is that all identified packages were first published on the very same day they were disclosed, indicating that these were newly introduced malicious artifacts rather than compromises of long-standing, established projects. This pattern suggests either fresh typosquatting attempts or the swift deployment of new, purpose-built malicious packages.
While a clear, overarching naming pattern—such as a shared @scope/ or a distinct prefix/suffix—was not immediately discernible across all 13 packages, the extremely narrow disclosure window serves as the primary indicator of a single, coordinated effort. The packages bear names like bcs-core, leb128x, sui-gql-core, sui-move-rpc, reseller-app, bucket-protocol-sdk-v2, bnpl-blocks-independent-bnpl-search, and bolt-delivery-menu-app. Their low download statistics, typically ranging from tens to a few hundreds per week, further support the assessment that these are newly minted malicious uploads. For instance, bnpl-blocks-independent-bnpl-search registered only 66 weekly downloads, while bucket-protocol-sdk-v2 had 516 weekly downloads, and reseller-app saw 101 weekly downloads. This low adoption rate is common for fresh typosquats or new malicious packages that have not yet gained significant traction. The lack of a strong naming theme suggests a more opportunistic or broad-spectrum approach rather than a highly targeted typosquatting campaign against a single popular library.
Specific behavioral findings from OpenSSF Package Analysis were not provided in the advisories for this particular burst. However, the consistent "Critical" severity ratings assigned to the packages for which GitHub Security Advisories (GHSAs) were issued strongly imply highly impactful malicious activity. Critical severity typically indicates vulnerabilities or malicious code that can lead to complete system compromise, remote code execution, or significant data exfiltration without user interaction. Without explicit behavioral details, it is prudent to assume the worst-case scenario regarding the capabilities of these malicious packages.
The consistent "Critical" severity assigned to packages like bcs-core, leb128x, sui-gql-core, sui-move-rpc, bucket-protocol-sdk-v2, bnpl-blocks-independent-bnpl-search, reseller-app, and bolt-delivery-menu-app underscores the severe risk posed to any system that may have installed them. A critical severity rating in the context of malicious packages means that the affected system should be considered fully compromised. This level of compromise typically allows attackers to gain unauthorized access, execute arbitrary code, steal sensitive data, or establish persistent footholds within the compromised environment. The implications are far-reaching, potentially affecting not only the immediate development environment but also any production systems where these packages might have been deployed.
Given the critical nature of these disclosures, developers and organizations are strongly advised to take immediate action. The first step is to audit all package-lock.json or yarn.lock files across projects to identify any instances of the malicious packages. If any of the following package names are found, they should be promptly removed: bcs-core leb128x sui-gql-core sui-move-rpc bucket-protocol-sdk-v2 bnpl-blocks-independent-bnpl-search reseller-app bolt-delivery-menu-app Beyond removal, it is imperative to assume a full compromise for any system that installed these packages. This means rotating all credentials, API keys, and sensitive tokens that may have been exposed or used on the affected machine. This rotation should be performed from a separate, untainted system to prevent further compromise. Additionally, organizations should review their npm token logs for any unauthorized publish events or suspicious activity that might indicate a broader breach of developer accounts. Implementing stricter access controls and multi-factor authentication for registry access can help mitigate future risks.
This coordinated drop of 13 malicious npm packages within such a compressed timeframe highlights the persistent and evolving threat landscape in open-source software supply chains. While the specific actor or motivation remains undisclosed, such rapid disclosures often point to automated tooling employed by attackers to quickly flood registries with malicious artifacts, or a highly efficient response by security teams to a detected campaign. The continuous emergence of new, short-lived malicious packages, often leveraging typosquatting or similar techniques, necessitates ongoing vigilance and robust security practices from developers and organizations relying on public package registries. The speed of disclosure in this instance also demonstrates the effectiveness of current detection mechanisms in identifying and removing threats, even if the initial attack vector remains a challenge to fully prevent.