npm: 28 Malicious Packages Dropped in Under a Minute, Featuring Varied Typosquats and Scoped Attacks
On September 21, 2026, 28 malicious npm packages were simultaneously disclosed, revealing a highly coordinated supply chain attack utilizing diverse naming conventions, including scoped packages and typosquats.
Key findings
- 28 malicious npm packages were disclosed simultaneously on September 21, 2026.
- All advisories were published within a single minute, indicating a highly coordinated attack.
- The campaign utilized diverse naming patterns, including the
@siriusbeyondscope andkeroeltoptyposquats. - Several packages, including
@siriusbeyond/authandstarbucks-sdk, were found to communicate with malicious domains. - All disclosed packages were assigned Critical severity, posing a significant risk to affected systems.
On September 21, 2026, 28 malicious packages were disclosed on the npm registry within a single minute, all at 06:30 UTC. This extremely tight disclosure window indicates a highly coordinated supply chain attack, with many of the packages having been first published just days before their takedown.
The attackers employed a variety of tactics to distribute these malicious packages, suggesting a multi-pronged approach rather than a single, easily identifiable naming convention. One prominent pattern involves the @siriusbeyond npm scope, with packages such as @siriusbeyond/ui, @siriusbeyond/auth, and @siriusbeyond/utils. The standalone package siriusbeyond also appears to be part of this family. Another set of packages, including keroeltopkkk, keroeltopgg, and keroeltopkk, appear to be typosquats targeting a common, unspecified legitimate package or a family of related malicious packages. Further evidence of automated generation or a themed campaign can be seen in packages like pf23727, pflag14570, and pf25133, which use numeric suffixes, and thematic names such as catwrestlinghuman and catwrestlingbird. Additionally, packages like commerce-materials and byted-commerce-materials, as well as element-plus-vite-cli and @asenfotech/unplugin-element-plus, indicate related efforts.
OpenSSF Package Analysis reports indicate that at least two of these packages, @siriusbeyond/auth and starbucks-sdk, exhibit behavior consistent with malicious activity, specifically communicating with external domains. While the specific command-and-control (C2) domains are not explicitly detailed in the advisories, this behavior typically involves exfiltrating sensitive information, downloading additional malware, or establishing persistent access to compromised systems.
All 28 disclosed packages were rated Critical severity, underscoring the severe risk posed to any system that installed them. Users who have installed any of these malicious packages should consider their systems fully compromised. This necessitates immediate action, including rotating all credentials and secrets from a separate, clean machine, as well as thorough system audits to detect and eradicate any persistent threats.
Developers should audit their package-lock.json or yarn.lock files for the presence of any of the malicious package names. A representative subset of these packages includes:
@siriusbeyond/authkeroeltopkkkpf23727starbucks-sdkcatwrestlinghuman
If any are found, immediate steps include isolating affected systems, revoking and regenerating all API keys, tokens, and other sensitive credentials, and scrutinizing npm token logs for any unauthorized publishing activity. This rapid, multi-faceted disclosure highlights the ongoing challenge of securing software supply chains against sophisticated attackers who leverage diverse techniques, from typosquatting to scoped package impersonation, to distribute malware. The extremely tight disclosure window suggests a concerted effort by security researchers or automated systems to identify and remove a wave of related threats.