npm: Coordinated Attack Uncovers 20 Malicious Packages Across `@coopeuch/` and `@s4yhiitestpoc/` Scopes
On October 11, 2026, 20 malicious npm packages, many under the `@coopeuch/` and `@s4yhiitestpoc/` scopes, were disclosed within a tight 10-minute window, indicating a coordinated supply chain attack.
Key findings
- 20 malicious npm packages disclosed within a 10-minute window on October 11, 2026
- Multiple packages shared the
@coopeuch/and@s4yhiitestpoc/npm scopes, indicating a coordinated campaign - Many packages were first published just 1-2 days before their disclosure, suggesting fresh malicious uploads
- Malicious packages typically aim to exfiltrate data, install backdoors, or execute arbitrary code
- Users who installed affected versions should consider systems compromised and rotate credentials
On October 11, 2026, 20 malicious packages were disclosed on the npm registry within a tight 10-minute window, from 13:50 UTC to 14:01 UTC. This rapid succession of advisories, many sharing common npm scopes, points to a coordinated malicious campaign targeting the software supply chain. Many of these packages were first published only one or two days prior to their disclosure, suggesting they were newly created for the attack rather than being compromises of existing, long-standing projects.
Campaign Signature and Naming Patterns
The campaign prominently featured two distinct npm scopes: @coopeuch/ and @s4yhiitestpoc/. Five packages, including @coopeuch/core (disclosed at 14:01 UTC), @coopeuch/components (14:00 UTC), @coopeuch/common (13:58 UTC), @coopeuch/button (13:51 UTC), and @coopeuch/config (13:51 UTC), were published under the @coopeuch/ scope. Similarly, three packages, such as @s4yhiitestpoc/scan-https-d (13:58 UTC), @s4yhiitestpoc/r2-https (13:58 UTC), and @s4yhiitestpoc/r3-https (13:58 UTC), utilized the @s4yhiitestpoc/ scope. The remaining packages, like react-paginate-v5, liferay-workspace-scripts, and nitro-bundled-dep, appear to be ad-hoc names, potentially typosquats or unrelated malicious drops that landed within the same tight window. A striking characteristic of many of these packages is their recency; for instance, @coopeuch/core was first published just one day before its disclosure, and liferay-workspace-scripts two days prior, indicating newly created malicious entities rather than compromised long-standing projects. All packages exhibited relatively low download counts, consistent with new malicious uploads that had not yet gained significant traction.
Malicious Behavior
While specific behavioral findings for each package were not detailed in the advisories, malicious packages in such campaigns commonly aim to exfiltrate sensitive data, install backdoors, or execute arbitrary code on compromised systems. These actions can lead to a wide range of detrimental outcomes, from credential theft and intellectual property loss to full system takeover. The rapid deployment and coordinated nature of this burst suggest a deliberate attempt to distribute harmful code across the npm ecosystem.
Severity of Compromise
The compromise of any software dependency should be treated with extreme seriousness. Users who installed these malicious packages should consider their systems fully compromised. It is critical to rotate all credentials, tokens, and sensitive information from a separate, clean machine, as the attacker may have gained unauthorized access to development environments or production systems. The potential impact extends to any downstream projects or users that may have inadvertently incorporated these malicious versions into their applications.
Detection and Response
Developers should immediately audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for any of the affected package names. If found, these packages must be removed, and all credentials, API keys, and other sensitive information that may have been exposed should be rotated from a separate, secure system. A representative list of affected packages includes:
@coopeuch/core(malicious version1.999.999)@s4yhiitestpoc/scan-https-d(malicious version1.0.0)nitro-bundled-dep(malicious versions99.0.1,2.0.1,1.1.0)react-paginate-v5(malicious version99.0.0)liferay-workspace-scripts(malicious version99.9.1)
Broader Context
This incident underscores the persistent threat of supply chain attacks, where attackers leverage package registries to distribute malicious code. The rapid disclosure of these packages within minutes highlights the ongoing efforts by security teams to detect and mitigate such threats quickly, but also serves as a reminder of the constant vigilance required from developers to secure their dependencies. The use of distinct scopes alongside ad-hoc names indicates a multi-pronged approach by the attackers, aiming for both targeted and opportunistic compromises.