npm: 20 Malicious Packages Disclosed Simultaneously in Coordinated Burst
On November 2, 2026, 20 malicious packages were simultaneously disclosed on the npm registry, indicating a coordinated attack characterized by diverse naming conventions and varied publication histories.
Key findings
- 20 malicious npm packages were simultaneously disclosed on November 2, 2026.
- All advisories were published at the exact same instant (09:44 UTC).
- A significant portion of packages follow an 'adjective_animal_color-number' naming pattern.
- Package publication dates range from 7 months to over 11 years prior to disclosure.
- The burst indicates a coordinated malicious campaign targeting the npm ecosystem.
On November 2, 2026, 20 malicious packages were simultaneously disclosed on the npm registry, all flagged and removed at 09:44 UTC. This coordinated burst, while lacking a single, clear naming pattern across all entries, points to a single, rapid deployment of various malicious modules, highlighting a concerted effort by attackers.
Unlike many coordinated campaigns that rely on clear naming conventions, this burst features a diverse set of package names. A significant portion, including hollow_wildebeest_silver-94, intimate_ostrich_amethyst-45, xenacious_kangaroo_blush-47, colossal_wallaby_pink-87, and inadequate_earwig_magenta-66, follow a distinct 'adjective_animal_color-number' pattern, strongly suggesting automated generation. Other packages, such as babyyodaa, et_phone_home, and gugodapis, appear more ad-hoc, potentially targeting specific typosquats or serving as standalone malicious modules. The first_published dates for these packages vary widely, from et_phone_home first appearing over 11 years ago, to @signals-notebook/annotation-editor published just 7 months prior to its disclosure. Many of the animal-themed packages were first published around 2.5 years ago, indicating a potential compromise of older, established accounts or a long-running, dormant campaign.
The advisories provided for this burst did not include specific behavioral findings detailing the malicious actions of these packages. However, the coordinated nature of their disclosure strongly implies a common malicious intent across the entire set, typically involving activities such as data exfiltration, remote code execution, or credential harvesting, common in supply chain attacks.
While specific details on the payloads were not provided, any system that installed a malicious package should be considered fully compromised. Best practices dictate that all secrets and credentials associated with the compromised system should be rotated immediately from a separate, secure machine, as attackers may have gained unauthorized access.
Developers are advised to audit their package-lock.json files and dependency trees for the presence of any of these malicious packages. If found, immediate action is required: remove the package, rotate all relevant credentials, and investigate for further compromise. A representative list of affected package names includes:
babyyodaaet_phone_homegugodapishollow_wildebeest_silver-94xenacious_kangaroo_blush-47
This burst highlights the ongoing challenge of securing software supply chains against rapid and coordinated attacks. The simultaneous disclosure of numerous packages, even without a universally consistent naming pattern, underscores the need for robust automated detection systems and vigilant dependency management practices to counter such swift deployments of malicious code. The varied first_published dates also suggest that attackers may be leveraging both newly created malicious packages and potentially compromised older accounts or dormant packages to maximize their reach and evade detection.