npm: 40 Malicious Packages, Including 10 'grafeno-' Impersonations, Dropped in Under a Minute
On August 29, 2026, 40 malicious npm packages, including a cluster impersonating 'grafeno-' related libraries, were disclosed within a single minute, indicating a highly coordinated attack.
Key findings
- 40 malicious npm packages were disclosed on August 29, 2026.
- All advisories were published within a single minute at 00:31 UTC.
- 10 of the packages shared the
grafeno-prefix, indicating a targeted impersonation. - Several packages, including
grafeno-auth, executed malicious commands upon installation. - All disclosed packages were rated Critical severity.
On August 29, 2026, 40 malicious packages were disclosed on npm within a single minute, all at 00:31 UTC. This rapid, coordinated drop suggests a deliberate campaign, with a significant portion of the packages specifically targeting or impersonating the 'grafeno-' ecosystem. The affected versions, such as grafeno-auth version 1.0.0, were flagged and removed from the registry on the same day.
While the overall burst of 40 packages did not exhibit a single, overarching naming pattern, a notable subset of 10 packages shared the grafeno- prefix, strongly suggesting a targeted impersonation campaign. These packages, all released with version 1.0.0, include grafeno-auth, grafeno-api, grafeno-pix, grafeno-client, grafeno-config, grafeno-core, grafeno-logger, grafeno-sdk, grafeno-utils, and spc-grafeno. The remaining packages, such as sycm-vendors (version 55.0.0), qbo-ui-services (version 45.0.0), and npm-extension (version 45.0.0), appear to be ad-hoc malicious drops, potentially typosquats or unrelated components, but were released in the same tight window.
Analysis of the disclosed packages reveals a consistent malicious behavior. Specifically, grafeno-auth, grafeno-api, and grafeno-pix were identified by OpenSSF Package Analysis as executing commands associated with malicious activity. This indicates that upon installation, these packages are designed to run arbitrary code on the affected system, potentially leading to system compromise, data exfiltration, or further malware deployment.
All 40 advisories were rated Critical severity, underscoring the severe risk posed by these packages. Developers who installed any of these malicious versions should consider their systems fully compromised. The immediate and critical action required is to rotate all sensitive credentials, such as API keys, tokens, and passwords, from a separate, clean machine, as these could have been exfiltrated by the malicious code.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious package names. If found, these dependencies must be removed, and a thorough security review of the affected environment is recommended. Furthermore, organizations should review their npm token logs for any unauthorized publish events that might indicate a compromise of their developer accounts. A representative list of some of the malicious packages includes:
grafeno-authgrafeno-apigrafeno-pixsycm-vendorsqbo-ui-servicesnpm-extensiontabbablessentrykit
This burst highlights the ongoing threat of supply chain attacks targeting package ecosystems like npm. The extremely tight disclosure window of under a minute for 40 distinct packages points to either a highly automated attack infrastructure or a coordinated takedown effort by security researchers. Regardless of the specific mechanism, the incident serves as a stark reminder of the need for continuous vigilance and robust security practices in software development workflows.