npm: 40 Malicious Packages Disclosed in Coordinated 11-Minute Drop
On August 12, 2026, 40 malicious npm packages were disclosed within an 11-minute window, indicating a coordinated supply chain attack targeting the JavaScript ecosystem.
Key findings
- 40 malicious npm packages were disclosed on August 12, 2026.
- All advisories were published within an 11-minute window.
- Many packages were newly published on the same day as their disclosure.
- Some packages shared the
@noxzacode/npm scope. - Numerous advisories received a Critical severity rating.
On August 12, 2026, a significant coordinated event unfolded on the npm registry, as 40 malicious packages were disclosed within a remarkably tight 11-minute window, from 10:20 UTC to 10:31 UTC. This rapid succession of advisories points to a concerted effort by attackers to inject harmful code into the software supply chain, followed by an equally swift response from security teams to identify and remove the threats. Many of these packages, such as @noxzacode/eslint-config and noxleys, were first published just hours before their disclosure, indicating they were fresh typosquats or newly introduced malicious components designed for immediate impact.
While no single, overarching naming pattern clearly unites all 40 packages, the extremely tight publication and disclosure window is a strong indicator of a coordinated campaign, likely executed through automated or semi-automated means. Within this burst, some packages, like @noxzacode/eslint-config and @noxzacode/libsignal-node, share a common npm scope, @noxzacode/, suggesting a more structured and potentially targeted sub-campaign. Other package names, such as dzvchorehui2, twcvhjlksdmx, egair0810, mobicommn, and cvbmxiowkwqla6, appear to be randomly generated strings or ad-hoc typosquats designed to evade detection or trick developers into accidental installation. The low download counts for most of these packages (e.g., kanyut with 12/week, mnmobicom with 154/week) are typical for newly published malicious artifacts before widespread adoption.
Specific behavioral findings for these packages were not detailed in the advisories; however, the critical severity assigned to many of the disclosures implies significant malicious functionality. Typically, packages flagged with critical severity aim to exfiltrate sensitive data, install backdoors, establish persistence, or execute arbitrary code on compromised systems. The goal of such attacks is often to gain unauthorized access to developer environments, steal credentials, or pivot to other systems within an organization's network.
The critical severity ratings associated with many of these advisories underscore the severe risk posed to any system that installed these malicious packages. A compromise of this nature typically means that the affected machine should be considered fully compromised. This necessitates immediate and comprehensive action, including rotating all credentials and secrets from a separate, secure machine, and thoroughly investigating the compromised system for any signs of further malicious activity or persistence mechanisms.
Developers are strongly advised to audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If any are found, immediate steps should be taken to remove them, rotate all potentially exposed credentials, and investigate for further compromise. A representative list of package names from this burst includes:
@noxzacode/eslint-config@noxzacode/libsignal-nodenoxleyskanyutdzvchorehui2twcvhjlksdmxmnmobicompassport811mobicommn
This burst of 40 malicious packages within a mere 11 minutes highlights the ongoing and evolving threat of supply chain attacks targeting package ecosystems like npm. The rapid deployment and subsequent takedown suggest an automated or semi-automated process by attackers, met with a vigilant and effective response by security teams. Such coordinated drops are a persistent challenge, requiring continuous monitoring and proactive security measures from both registry maintainers and developers to safeguard the integrity of the software supply chain.