npm: 22 Malicious Packages Disclosed in 9-Minute Coordinated Burst on June 16, All Same-Day Registrations

Key findings

All 22 packages were disclosed within a single 9-minute window on 2026-06-16, between 06:03 and 06:12 UTC
Every package was first published on the same day (June 16, 2026) — a same-day register-and-burn pattern with no pre-existing install base
13 of 22 packages carry GHSA Critical severity ratings; 9 carry MAL database entries, with several receiving dual coverage
Package names span multiple themes: authentication (auth-basic-vault, rbac-auth), terminal logging (terminal-pretty-logger), UI libraries (lucide-next), and SDK tooling
No shared naming prefix or scope — the campaign signature is purely temporal, with all 22 packages registered and removed on the same day
The highest-traffic package, terminal-pretty-logger, drew only ~830 weekly downloads at disclosure, reflecting the brief exposure window before takedown

The June 16 npm Malware Drop: 22 Packages in 9 Minutes

On June 16, 2026, between 06:03 and 06:12 UTC, 22 malicious packages were disclosed on the npm registry in a tightly coordinated nine-minute window. Every package in this burst was registered on the same day — June 16, 2026 — and every one was flagged and removed within hours, before any could accumulate meaningful download counts. The advisory sources split between GitHub Security Advisories (GHSA, 13 entries) and the OpenSSF Malware Database (MAL, 9 entries), with several packages receiving dual coverage across both feeds.

No single naming pattern, but a clear campaign fingerprint

Unlike many coordinated drops that share an obvious @scope/ or a common prefix, this burst lacks a single naming convention. Instead, the packages span a range of plausible-sounding utility names — hot-validation-sdk, fabric-graphics, auth-basic-vault, authcascade, swplayer-react-sl, simple-auth-basic, pampipes, lucide-next, rbac-auth, terminal-pretty-logger, terminal-structured-logger, bign.tsm, and npmjs-doc-builder. The diversity of names suggests the attacker was not relying on a single automated template but rather generating or selecting names from multiple thematic buckets: authentication libraries (auth-basic-vault, simple-auth-basic, rbac-auth, authcascade), terminal/logging utilities (terminal-pretty-logger, terminal-structured-logger), graphics and UI (fabric-graphics, lucide-next, swplayer-react-sl), and documentation or SDK tooling (npmjs-doc-builder, hot-validation-sdk).

What ties them together is not the names but the timing and the registry metadata: every single package was first published on June 16, 2026 — the same day the advisories landed. This is a classic same-day-register-and-burn pattern: the attacker created fresh npm accounts, pushed packages, and the malware was detected and removed within the same 24-hour window. No package in this set had existed before June 16; none had accumulated a legacy install base. The highest-traffic package, terminal-pretty-logger, drew only ~830 weekly downloads at the time of disclosure — a number that reflects the brief window of exposure before takedown, not a sustained install base.

What the malware does

The GHSA advisories for this burst carry the standard critical-severity boilerplate: any version ">= 0" is affected, meaning the entire package lineage is considered malicious. While the input does not include detailed OpenSSF Package Analysis behavioral findings for each entry, the consistent severity rating across all 13 GHSA entries — every one marked Critical — signals that these packages are not merely suspicious but are confirmed to contain active malicious payloads. The pattern of same-day registration, immediate disclosure, and critical classification across two independent advisory sources (GHSA and MAL) is the hallmark of an automated malware detection pipeline catching a coordinated push in near-real-time.

Packages like auth-basic-vault, simple-auth-basic, and rbac-auth are particularly concerning because their names mimic legitimate authentication middleware patterns. A developer searching for "simple auth basic npm" or "rbac auth node" could easily land on one of these packages, install it, and unwittingly import credential-harvesting code into their project. The lucide-next package is a clear typosquat play on the popular lucide-react icon library, while terminal-pretty-logger (note the typo: "pretty" not "pretty") targets developers looking for terminal formatting utilities.

Severity and impact

The GHSA critical rating means the same thing it always means: any machine that installed any of these packages should be considered fully compromised. The advisory language — consistent across all 13 GHSA entries — recommends rotating all secrets and keys from a separate, unaffected machine. For the packages in this burst, the practical impact is limited by the speed of detection: with all packages registered and removed on the same day, the window of exposure was measured in hours, not weeks. The highest-download package, terminal-pretty-logger at ~830/week, likely saw only a handful of actual installs before the malicious version was pulled.

But the low download counts should not breed complacency. The attacker's strategy — register dozens of packages across multiple naming themes, push them simultaneously, and hope a few slip past detection long enough to catch a developer's npm install — is a volume play. The fact that 22 packages were caught in a single nine-minute burst suggests the detection pipeline worked as designed. It also suggests the attacker may have pushed many more packages that were not caught, or that similar bursts targeting different naming themes may be in progress.

Detection and response

Developers who ran npm install on June 16, 2026, should audit their package-lock.json or node_modules for any of the following package names:

hot-validation-sdk
fabric-graphics
auth-basic-vault
authcascade
swplayer-react-sl
simple-auth-basic
pampipes
lucide-next
rbac-auth
terminal-pretty-logger
terminal-structured-logger
bign.tsm
npmjs-doc-builder

If any of these appear in a project's dependency tree, the recommended course of action is unambiguous: rotate all credentials — npm tokens, environment variables, API keys, database passwords — from a clean machine, revoke any npm tokens that may have been exposed, and audit the project for unexpected outbound network connections. The packages should be removed and replaced with legitimate alternatives where applicable.

The broader picture

This burst fits a well-established pattern in the npm ecosystem: coordinated malicious package drops that leverage same-day registration to evade pre-publication review. The nine-minute window across 22 packages is unusually tight, suggesting a single actor or automated pipeline pushing packages in rapid succession. The absence of a shared naming prefix or scope is notable — most coordinated campaigns leave a clearer forensic signature in the package names themselves. Here, the signature is purely temporal: 22 packages, all registered on the same day, all disclosed within a single nine-minute span.

The dual coverage across GHSA and MAL feeds indicates that both GitHub's advisory system and the OpenSSF Malware Database independently flagged packages in this burst, with some packages receiving entries in both systems. This redundancy is a healthy sign for the ecosystem's detection infrastructure: multiple independent pipelines catching the same malicious packages means fewer chances for any single package to slip through.

For developers, the takeaway is simple: same-day packages with plausible-sounding names are a red flag. A package called terminal-pretty-logger that was registered hours ago and has no GitHub stars, no issues, and no provenance is not a legitimate utility — it is a trap. The speed of detection in this burst is encouraging, but the fact that 22 malicious packages were pushed to the registry in the first place is a reminder that npm's open-registry model remains a target for automated malware distribution at scale.