npm: 40 Malicious Packages Disclosed in Coordinated One-Minute Drop
On August 29, 2026, 40 malicious npm packages were simultaneously disclosed, all within a single minute, indicating a highly coordinated takedown.
Key findings
- 40 malicious npm packages were disclosed.
- All advisories were published within a one-minute window on August 29, 2026.
- All 40 packages were assigned a Critical severity rating.
- Many packages were published just hours before their disclosure.
- No clear common naming pattern or shared scope was detected across the packages.
On August 29, 2026, 40 malicious packages were disclosed on the npm registry within a remarkably tight one-minute window, between 18:12 UTC and 18:13 UTC. All identified packages were flagged with Critical severity, pointing to a significant and coordinated threat. Many of these packages, such as ux-metrics-client-interaction-subscriber and oit-lib-oracle-util, were first published just 17 hours prior to their disclosure, suggesting they were fresh malicious uploads or typosquats. However, a notable subset, including librastandardlib (first published 5 months ago) and amplitude-react-native (first published 6 months ago), indicates a mix of attack vectors, potentially involving dormant threats or compromised older, low-download projects.
Unlike some coordinated campaigns that rely on shared naming conventions, this burst of 40 npm packages does not exhibit a clear common prefix, suffix, or npm scope. This absence of a uniform naming pattern suggests a potentially diverse set of targets or an attacker employing varied strategies, possibly including ad-hoc typosquatting or targeting specific internal-looking package names. Examples of the package names found in this burst include ux-metrics-client-interaction-subscriber, oit-lib-oracle-util, paper-password-input, npm-extension, and calcite-web. The varied nature of these names, ranging from generic to seemingly enterprise-specific, further complicates the identification of a single overarching theme.
While specific behavioral findings from OpenSSF Package Analysis were not available for this set of advisories, the consistent 'Critical' severity rating across all 40 packages strongly implies severe malicious functionality. Typically, such high-severity ratings are associated with actions like credential exfiltration, remote code execution, or the establishment of persistent backdoors. The immediate and widespread disclosure suggests that security researchers identified a significant threat that warranted rapid removal from the registry.
The consistent 'Critical' severity assigned to all 40 packages means that any system that installed these malicious versions should be considered fully compromised. Developers and organizations are advised to treat affected machines as untrusted, immediately rotate all sensitive credentials (API keys, tokens, passwords) from a separate, secure system, and conduct a thorough forensic analysis to identify the extent of the compromise. The potential for data exfiltration or further system compromise is extremely high with packages rated at this level of severity.
Developers should immediately audit their package-lock.json and yarn.lock files for the presence of any of the disclosed malicious packages. If any are found, the affected dependencies must be removed, and all credentials associated with the build environment or deployment pipelines should be rotated. It is also crucial to review npm token logs for any unauthorized publish activities. A representative list of affected packages includes:
ux-metrics-client-interaction-subscriberoit-lib-oracle-utilpaper-password-inputnpm-extensioncalcite-webamplitude-react-nativelibrastandardlib
This coordinated disclosure of 40 malicious npm packages within a single minute highlights the ongoing and evolving threat landscape in software supply chains. While the lack of a clear campaign signature makes attribution or specific targeting difficult, the rapid disclosure of so many packages suggests either a highly automated malicious operation or a swift response by security researchers to a newly identified threat vector. The mix of newly published packages and some older ones indicates attackers are using multiple strategies, from fresh typosquats to potentially compromising existing, albeit low-download, projects, underscoring the need for continuous vigilance in dependency management.