npm: Malicious Packages Under '@baanx/' and '@insiderintelligence/' Scopes Disclosed in 11-Minute Burst
On September 24, 2026, 11 malicious npm packages, primarily targeting the '@baanx/' and '@insiderintelligence/' scopes, were disclosed within an 11-minute window.
Key findings
- 11 malicious npm packages disclosed on September 24, 2026
- All advisories published within an 11-minute window
- Multiple packages impersonated the
@baanx/and@insiderintelligence/npm scopes - Most malicious packages were published just 1-4 days before disclosure
- All disclosed packages were rated with Critical severity
On September 24, 2026, 11 malicious packages were disclosed on npm within an 11-minute window, primarily targeting the @baanx/ and @insiderintelligence/ scopes. These packages, many of which were published just 1-4 days prior to their disclosure, represent a swift, coordinated effort to introduce malicious code into the npm ecosystem.
The coordinated nature of this burst is evident in the shared npm scopes used by a significant portion of the malicious packages. Five packages, including @baanx/domain, @baanx/solana-lib, @baanx/common, @baanx/abis, and @baanx/blockchain-config, all leveraged the @baanx/ scope. Similarly, two packages, @insiderintelligence/componentlibrary and @insiderintelligence/googleadmanager, were published under the @insiderintelligence/ scope. This pattern suggests an attacker attempting to impersonate legitimate organizations or projects by creating similarly scoped packages, likely to capitalize on typosquatting or supply chain confusion. The rapid publication and subsequent disclosure within minutes further underscore the coordinated nature of this attack.
While specific behavioral findings from OpenSSF Package Analysis were not detailed in the advisories for these packages, the 'Critical' severity assigned to all disclosed packages indicates a high potential for severe impact. Malicious packages often aim to exfiltrate sensitive information, install backdoors, or execute arbitrary code on compromised systems. The rapid disclosure suggests that these packages likely contained immediate and detectable malicious payloads designed to compromise developer environments or downstream applications.
The 'Critical' severity rating for all 11 packages means that any system that installed these malicious versions should be considered fully compromised. Attackers could gain unauthorized access to sensitive data, credentials, or even control over the affected development environment. Users are strongly advised to treat such compromises with the utmost urgency, rotating all secrets and credentials from a separate, secure machine.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all associated credentials (e.g., npm tokens, API keys) should be rotated. Furthermore, administrators should review npm token logs for any unauthorized publish activity. A representative list of the malicious packages includes:
@baanx/domain@insiderintelligence/componentlibrary@baanx/solana-lib@rixxcodex/baileyspino-testkit
This incident highlights the ongoing threat of supply chain attacks targeting package ecosystems like npm. The use of scoped packages to impersonate legitimate entities, combined with rapid publication and disclosure, underscores the agility of attackers in attempting to inject malicious code. Such coordinated bursts emphasize the need for continuous vigilance and robust security practices in software development workflows.