npm: 40 Malicious Packages in 'abina-amug' Campaign Disclosed Within 21 Minutes
On August 14, 2026, forty malicious npm packages, many sharing the `abina-amug` prefix, were disclosed within a tight 21-minute window, indicating a coordinated supply chain attack.
Key findings
- Forty malicious npm packages were disclosed on August 14, 2026.
- All advisories were published within a tight 21-minute window.
- Many packages share the
abina-amugorabina-amugiprefix, indicating a campaign signature. - The burst included both newly published malicious packages and others dormant for over two years.
- All disclosed packages were assigned a Critical severity rating.
On August 14, 2026, forty malicious packages were disclosed on npm within a 21-minute window, revealing a coordinated campaign targeting the JavaScript ecosystem. This rapid succession of advisories, all published between 11:13 UTC and 11:35 UTC, points to a single, concerted effort to distribute malicious code. While many of these packages were freshly published just hours before their disclosure, a significant subset, primarily those prefixed with abina-amug, had been dormant on the registry for over two years, first appearing in May 2024.
Campaign Signature and Naming Patterns
The campaign exhibits a clear naming pattern among a large portion of the disclosed packages. Twenty-four of the forty packages share a common prefix, either abina-amug or abina-amugi, followed by various suffixes such as amm, anuai, or anucmai. This consistent naming suggests a deliberate strategy, possibly for typosquatting or to create a deceptive sense of legitimacy within a specific namespace. Examples of these packages include:
abina-amugmi-ammabina-amugi-anuaiabina-amugui-anucmaiabina-amugmi-amamagu
Beyond this primary signature, other packages in the burst appear to be more ad-hoc, with names like angular2-tesla-common, redux-saga-task-cancel-rce, and cspotcode. These varied names, alongside the abina-amug family, suggest a multi-pronged approach within the same coordinated disclosure event, potentially combining targeted and more generic malicious uploads.
Malicious Behavior and Severity
All forty disclosed packages were assigned a Critical severity rating. While specific behavioral findings from OpenSSF Package Analysis were not detailed in the advisories, a Critical severity typically indicates that the package contains code designed to perform highly damaging actions. This could include remote code execution, credential exfiltration, or the establishment of persistent backdoors on systems where the package is installed. The lack of specific behavioral details does not diminish the threat; rather, it underscores the immediate and severe risk posed by these packages.
Impact and Mitigation
Given the Critical severity, any system that installed these packages should be considered fully compromised. The potential impact ranges from data theft and unauthorized access to complete system takeover. Developers and organizations are strongly advised to take immediate action to mitigate potential damage.
Detection and Response
To detect and respond to this threat, developers should:
1. Audit Dependencies: Immediately scan package-lock.json or yarn.lock files across all projects for the presence of any of the malicious package names. A representative subset of the affected packages includes: angular2-tesla-common amplitude-ma-ts redux-saga-task-cancel-rce cspotcode abina-amugmi-amm abina-amugi-anuai @genoma-ui/components zip-bundle 2. Rotate Credentials: If any of these packages are found, assume compromise and rotate all sensitive credentials (API keys, tokens, passwords) that may have been accessible from the affected build environments or systems. This should be done from a separate, clean machine. 3. Check Logs: Review npm token logs for any unauthorized publish events or suspicious activity originating from compromised accounts.
Broader Context
This burst highlights the ongoing challenge of supply chain security in package ecosystems like npm. The combination of freshly uploaded malicious packages and older, dormant ones being flagged in a single, coordinated disclosure event suggests a sophisticated adversary. Such rapid, multi-faceted drops underscore the need for continuous vigilance and robust security practices in software development workflows.