npm: 37 Malicious Packages Mimicking Social Media APIs and Mobile Dev Tools Disclosed in Under a Minute
On October 25, 2026, 37 malicious npm packages, many impersonating social media API wrappers and mobile development tools, were simultaneously disclosed.
Key findings
- 37 malicious npm packages disclosed within a single minute on October 25, 2026
- Packages impersonate social media API wrappers, scrapers, and mobile development tools
- All packages were published just 23 hours before their disclosure, indicating rapid deployment
- Many packages were assigned 'Critical' severity by GitHub Security Advisories
- Examples include
insta-api-wrapper,tiktok-video-scraper, andappit-cordova-plugin-ionic
On October 25, 2026, 37 malicious packages were simultaneously disclosed on the npm registry, all within a single minute. These packages, many impersonating social media API wrappers, scrapers, and mobile development tools, were all published just 23 hours prior to their disclosure, indicating a rapid deployment and takedown.
The malicious packages exhibit a strong thematic pattern, primarily impersonating libraries related to social media platform APIs and scrapers, as well as mobile application development tools. Examples include insta-api-wrapper, tiktok-video-scraper, ionic-youtube-search, and youtube-search-without-api-key, which mimic functionality for popular platforms. Other packages, such as appit-cordova-plugin-ionic and cordova-plugin-geofence-appit, appear to target developers working with mobile frameworks. A smaller subset, like cert-infos and ocsp-hashes, suggest an attempt to masquerade as security or utility libraries.
Details regarding the specific malicious behavior of these packages, such as command execution or communication with C2 servers, were not explicitly provided in the advisories. However, the consistent 'Critical' severity assigned to many of these packages indicates a high potential for severe system compromise upon installation.
The consistent 'Critical' severity assigned to many of these packages by GitHub Security Advisories (GHSA) underscores the severe risk posed to any system that installed them. Developers are advised to consider any machine that installed these malicious packages as fully compromised. This necessitates immediate action, including rotating all sensitive credentials from a separate, clean machine and thoroughly auditing the affected environment.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all credentials associated with the development environment, including npm tokens, should be rotated. A representative list of affected packages includes:
insta-api-wrappertiktok-video-scraperionic-youtube-searchappit-cordova-plugin-ioniccert-infosredis-dumper
This burst of 37 malicious npm packages, deployed and disclosed within a remarkably tight timeframe, highlights the ongoing threat of supply chain attacks targeting popular ecosystems. The thematic targeting of social media API functionalities and mobile development tools suggests an attacker aiming to capitalize on common developer needs, distributing malware that could lead to widespread compromise if not swiftly detected and removed.