npm: 14 Malicious Packages Disclosed in Coordinated 20-Minute Drop, Including 'base65-' Family
On August 11, 2026, 14 malicious npm packages, many sharing a `base65-` naming convention, were disclosed within a tight 20-minute window, indicating a coordinated supply chain attack.
Key findings
- 14 malicious npm packages disclosed on August 11, 2026.
- All advisories published within a 20-minute window.
- Multiple packages share a
base65-naming prefix, indicating a campaign. - Several packages were published just hours before disclosure, suggesting fresh malicious uploads.
- Two packages,
zeal-rq-hooksandwhs4_ued, were rated Critical severity.
On August 11, 2026, 14 malicious packages were disclosed on the npm registry within a tight 20-minute window, signaling a coordinated supply chain attack. This rapid succession of advisories, all published between 18:30 UTC and 18:50 UTC, points to a deliberate effort to inject harmful code into the ecosystem. Many of these packages, including a family sharing the base65- prefix, were first published just hours or days before their disclosure, indicating fresh malicious uploads rather than compromises of long-standing projects.
The campaign exhibits several distinct patterns, most notably a series of packages prefixed with base65-. Six packages, including base65-11x, base65-12x, base65-13x, base65-15x, base65-33x, and base65-77x, all follow this naming convention. These packages were all published on August 11, 2026, within hours of their disclosure, suggesting they are fresh malicious uploads designed to impersonate or typosquat legitimate utilities. Another distinct pattern is observed with the scoped package @dgn-src-click-to-pay-org/srcdcfreleasecert, which appears alongside a similarly named unscoped package, dcfarguscert, hinting at a potential sub-campaign or related targeting strategy. Other packages, such as chapters-core, bjm-low-code-components, and dependencyfsdsfdsfg, appear to be ad-hoc malicious uploads, potentially leveraging common or generic names to attract downloads.
While the specific behavioral findings for each package were not detailed in the public advisories, the nature of such coordinated attacks typically involves common supply chain attack vectors. These often include attempts to exfiltrate sensitive environment variables, steal credentials or API tokens, or establish remote code execution capabilities on compromised systems. The rapid disclosure of these packages indicates that they were quickly identified and removed from the registry before widespread analysis of their exact payloads could be publicly disseminated.
Two of the disclosed packages, zeal-rq-hooks and whs4_ued, were explicitly rated with Critical severity. This designation implies that any system that installed these specific malicious versions should be considered fully compromised. For affected users, the immediate and critical recommendation is to treat the compromised environment as untrusted. This necessitates rotating all sensitive credentials, API keys, and secrets from a separate, secure machine, as these could have been exfiltrated by the malicious code.
Developers are urged to proactively audit their project dependencies to identify any exposure to these malicious packages. This involves checking package-lock.json or yarn.lock files for the presence of the disclosed package names. If any of these packages are found, immediate action is required: isolate the affected system, revoke and rotate all potentially compromised credentials, and investigate for any unauthorized activity. A representative list of package names to check includes:
chapters-corebjm-low-code-componentsghazaly@dgn-src-click-to-pay-org/srcdcfreleasecertdcfarguscertdependencyfsdsfdsfgbase65-11xbase65-77xzeal-rq-hookswhs4_ued
This incident serves as a stark reminder of the persistent and evolving threat landscape within open-source software supply chains. The coordinated nature and rapid deployment of these packages underscore the sophisticated tactics employed by adversaries to bypass security measures and inject malicious code. Vigilance, continuous dependency scanning, and robust security practices remain essential for developers to mitigate the risks posed by such targeted attacks on public registries like npm.