npm: 13 Malicious Packages Drop in 8-Minute Window, Featuring 'statist-browser' and '-kit' Patterns
On August 8, 2026, thirteen malicious npm packages were disclosed within an 8-minute window, exhibiting patterns like the `statist-browser-typed-client-eventea.projects.` prefix and the `-kit` suffix.
Key findings
- 13 malicious npm packages disclosed on August 8, 2026
- All packages appeared within a tight 8-minute window
- Packages were first published just hours before disclosure
- Several packages share the
statist-browser-typed-client-eventea.projects.prefix - Other packages exhibit a common
-kitsuffix - All disclosed packages were rated with Critical severity
On August 8, 2026, a rapid succession of thirteen malicious packages was disclosed on the npm registry, all within a tight 8-minute window between 17:19 UTC and 17:27 UTC. These packages, rated with Critical severity, were notably all first published on the same day, just hours before their detection and removal, suggesting a swift deployment and takedown operation by security teams. This coordinated burst highlights the persistent threat of newly introduced malicious code targeting the software supply chain.
While no single overarching campaign signature like a shared @scope/ was identified, the disclosed packages exhibit distinct naming patterns indicative of a coordinated effort. Five of the packages share a lengthy common prefix: statist-browser-typed-client-eventea.projects.. Examples include statist-browser-typed-client-eventea.projects.tdevice, statist-browser-typed-client-eventea.projects.pwakasko, and statist-browser-typed-client-eventea.projects.pwahelp. This highly specific prefix suggests either an attempt to impersonate an internal project or a unique identifier used by the threat actor. Separately, four other packages share a common -kit suffix, such as svelte-kit-cache, streak-map-kit, svelte-streak-kit, and map-streak-kit. The remaining packages, like test-noexist-xyz-99 and specials-resources-server, appear to be more ad-hoc, potentially serving as additional vectors or tests within the same malicious operation. The low download count observed for bnpl-blocks-desktop-bnpl-anchor-title (206/week) is typical for newly published malicious packages that are quickly identified and removed, limiting their potential reach.
Although specific behavioral findings from OpenSSF Package Analysis were not detailed for this particular burst, the consistent Critical severity rating across all thirteen packages indicates a severe security risk. Packages with this classification typically aim for maximum compromise, often attempting to execute arbitrary code on the victim's system. This could involve actions such as exfiltrating sensitive environment variables, stealing credentials (like API keys or authentication tokens), establishing persistent backdoors, or downloading and executing secondary payloads. The immediate disclosure and removal of these packages underscore the urgency of mitigating such threats before they can gain widespread adoption.
The Critical severity assigned to these packages means that any system that installed one of the malicious versions should be considered fully compromised. The standard advice in such situations is to treat the affected machine as untrustworthy. This necessitates a comprehensive incident response, including isolating the compromised system, rotating all credentials and secrets that may have been exposed (especially those accessible from the build environment or runtime where the package was installed), and thoroughly auditing for any unauthorized changes or persistent access mechanisms left behind by the malware. It is crucial to perform these recovery steps from a known clean machine to prevent further compromise.
Developers and organizations are advised to immediately audit their package-lock.json or yarn.lock files for the presence of any of these malicious package names. If found, the packages must be removed, and a full security review of the affected project and environment should be initiated. Given the nature of supply chain attacks, it is also prudent to review npm token logs for any unauthorized publish events, which could indicate a compromised maintainer account. A representative list of the malicious packages includes:
statist-browser-typed-client-eventea.projects.tdevicestatist-browser-typed-client-eventea.projects.pwakaskosvelte-kit-cachestreak-map-kitmap-streak-kitbnpl-blocks-desktop-bnpl-anchor-title
Developers should remain vigilant and implement robust supply chain security practices, including dependency scanning and integrity checks, to detect and prevent similar threats.
This burst of malicious npm packages, rapidly deployed and swiftly taken down, exemplifies the ongoing cat-and-mouse game between threat actors and security researchers in the open-source ecosystem. The use of varied naming patterns, including specific prefixes and common suffixes, suggests an automated or semi-automated approach to package generation and deployment, designed to evade simple detection rules. While the immediate removal limits their potential impact, such incidents highlight the need for continuous monitoring and rapid response capabilities to protect the integrity of the software supply chain. The short lifespan of these packages on the registry is a testament to the effectiveness of current detection mechanisms, but also a reminder of the constant pressure to evolve defenses against increasingly sophisticated attacks.