npm: Coordinated Campaign Floods Registry with 34 Malicious Packages Under '@years17' and '@years18' Scopes
On August 12, 2026, 40 malicious npm packages were disclosed within a 25-minute window, with 34 of them belonging to a coordinated campaign leveraging the `@years17` and `@years18` npm scopes.
Key findings
- 40 malicious npm packages disclosed on August 12, 2026, within a 25-minute window.
- 34 packages belong to a coordinated campaign using
@years17and@years18npm scopes. - Many advisories were assigned a 'Critical' severity rating.
- Some packages, like
dakumangalsingh, were published just 1-2 days before disclosure. - Potential C2/exfiltration domains, such as
app.upshift.finance, were associated with some packages.
On August 12, 2026, 40 malicious packages were disclosed on npm within a 25-minute window, indicating a coordinated supply chain attack. The majority of these packages, 34 in total, first reported between 12:14 UTC and 12:39 UTC, share distinct naming patterns under the @years17 and @years18 npm scopes.
Campaign Pattern and Naming
The core of this campaign revolves around two distinct but related naming patterns: packages under the @years17 scope, such as @years17/n8n-nodes-helper-utils and @years17/n8n-nodes-utils-helper-b, and a larger set under the @years18 scope, including @years18/n8n-nodes-utils-helper-a and @years18/n8n-nodes-utils-helper-q. These packages often append a letter suffix, suggesting automated generation or a systematic approach to flooding the registry. The rapid disclosure of these packages, many appearing just 1-2 days after their initial publication, points to fresh malicious drops. For instance, dakumangalsingh (MAL-2026-13879) was first published just one day before its disclosure. Similarly, augustdigital-sdk (GHSA-pfx4-g5xh-hpf6) and upshift-config (GHSA-75gq-p797-7w4c) were both published two days prior to being flagged. While the majority follow this pattern, the burst also included a few seemingly unrelated malicious packages like mcp-util-helpers, permit2, and upshift-finance.
Malicious Behavior
While specific behavioral findings were not detailed in the provided advisories for all packages, the consistent 'Critical' severity assigned to many of them suggests a high potential for severe compromise. For instance, the package dakumangalsingh (MAL-2026-13879) was associated with dakumangalsingh.exe, indicating potential for executable drops. Similarly, upshift-finance (GHSA-p98f-6986-rf79) and upshift-config (GHSA-75gq-p797-7w4c) are likely related to the domain app.upshift.finance, suggesting potential command-and-control (C2) communication or data exfiltration, possibly targeting financial services.
Severity and Impact
The consistent 'Critical' severity ratings across many of these advisories underscore the severe risk posed to any system that installed these malicious packages. Such compromises typically mean that the affected system should be considered fully breached, requiring immediate action to rotate all sensitive credentials and secrets from a separate, secure machine.
Detection and Response
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed packages. If found, affected systems should be treated as compromised. It is crucial to rotate all credentials, API keys, and tokens that may have been exposed, performing this action from a clean, uncompromised machine. Additionally, administrators should review npm token logs for any unauthorized publish activities. A representative list of affected packages includes: @years17/n8n-nodes-helper-utils @years18/n8n-nodes-utils-helper-a dakumangalsingh upshift-finance
Broader Context
This coordinated burst of malicious packages highlights the persistent and evolving threat of software supply chain attacks. The use of similar naming conventions across multiple scopes suggests a methodical approach by attackers to flood the registry with malicious code, aiming to capitalize on typos or automated dependency resolution. Such incidents underscore the need for robust security practices, including dependency integrity checks and vigilance against newly published packages.