npm: 40 Malicious 'eka-' Prefix Packages Dropped in 2-Minute Coordinated Attack
On September 6, 2026, 40 malicious npm packages, all sharing the 'eka-' prefix, were disclosed within a tight two-minute window, indicating a highly coordinated supply chain attack.
Key findings
- 40 malicious npm packages disclosed within a 2-minute window on 2026-09-06.
- All packages share the common prefix
eka-, indicating a coordinated campaign. - All advisories are classified with Critical severity.
- Affected systems should be considered fully compromised; credentials must be rotated.
- Package names like
eka-empal71-slueyandeka-enting87-brekiare examples of the naming convention.
On September 6, 2026, 40 malicious packages were disclosed on npm within a two-minute window, from 23:34 UTC to 23:36 UTC. This rapid succession of advisories, all sharing the distinctive eka- prefix, points to a highly coordinated supply chain attack targeting the npm ecosystem.
The campaign is characterized by a consistent naming convention, with all disclosed packages beginning with eka-. This prefix is followed by a combination of words and numbers, such as eka-empal71-sluey, eka-enting87-breki, eka-esdoger71-pore, eka-bubursumsum84-sumpek, and eka-donat34-sluey. This pattern suggests either automated generation or a themed approach to package naming, likely designed to evade detection or to appear innocuous. While some packages were first published as recently as 10 months ago, others date back over two years, indicating a possible strategy of utilizing older, potentially dormant accounts or a long-running campaign. The download counts for these packages are generally low, typically in the single digits per week, suggesting they might be targeting specific, niche environments or are part of an early-stage reconnaissance effort.
While the specific behavioral findings from OpenSSF Package Analysis are not detailed in the advisories for this burst, packages of this nature typically aim to compromise developer environments. Common malicious behaviors include exfiltrating sensitive environment variables, stealing credentials (such as npm tokens or cloud API keys), establishing persistence, or deploying backdoors for remote code execution. The absence of specific IOCs in the provided data means the exact command-and-control infrastructure or data exfiltration targets remain unknown for this particular set of packages.
All 40 advisories are classified with Critical severity. This designation implies that any system that installed one of these malicious packages should be considered fully compromised. Users are strongly advised to treat such systems as untrusted, immediately rotate all credentials and secrets that may have been exposed, and perform these actions from a separate, secure machine to prevent further compromise.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any packages matching the eka- prefix. If any of these packages are found, they must be removed, and all credentials associated with the compromised development environment should be rotated. This includes npm tokens, cloud provider API keys, and any other sensitive information that might have been accessible. A representative list of affected package names includes:
eka-empal71-slueyeka-enting87-brekieka-esdoger71-poreeka-bubursumsum84-sumpekeka-donat34-sluey
This burst of 40 malicious packages within a mere two minutes highlights the ongoing threat of supply chain attacks in the open-source ecosystem. The coordinated nature and consistent naming pattern suggest a deliberate and organized effort to inject malicious code. While the immediate impact of these low-download packages might be limited, such campaigns contribute to the broader challenge of maintaining trust and security in widely used package registries like npm.