npm: Malicious '@test1230504' and 'z-deno-truth' Packages Drop in Coordinated 21-Minute Burst
On September 23, 2026, 17 malicious npm packages, including those under the `@test1230504` scope and `z-deno-truth` prefix, were disclosed within a tight 21-minute window.
Key findings
- 17 malicious npm packages disclosed within a 21-minute window on September 23, 2026.
- Multiple distinct campaigns identified, including packages under the
@test1230504scope andz-deno-truthprefix. - Many packages were first published just one day before disclosure, indicating fresh, rapid attacks.
- Several packages were rated Critical severity, implying full system compromise.
- One campaign utilized the command-and-control domain
already-query-bacteria-agreed.trycloudflare.com. - Affected packages include
@test1230504/string-format-helperandz-deno-truth-va499w.
On September 23, 2026, the npm ecosystem experienced a significant and rapid influx of malicious packages, leading to the disclosure of 17 advisories within an exceptionally tight 21-minute window, specifically between 04:48 UTC and 05:09 UTC. This concentrated activity strongly indicates a coordinated attack by threat actors, deploying multiple distinct campaigns in quick succession. A notable characteristic of this burst is that many of the identified packages, including those under the @test1230504 scope and those prefixed with z-deno-truth-, were first published on the registry just one day prior to their disclosure. This extremely short lifespan on the registry before being flagged suggests a strategy of rapid deployment and immediate exploitation, aiming to compromise as many targets as possible before detection and removal.
The disclosed packages reveal at least three distinct naming patterns, providing clear evidence of multiple, yet simultaneously executed, malicious campaigns. The most prominent pattern encompasses six packages published under the @test1230504/ npm scope, including specific examples such as @test1230504/string-format-helper, @test1230504/probe-7f3k2m-utils, and @test1230504/test-publish-verify. These scoped packages often mimic legitimate utility libraries, leveraging the trust associated with well-structured package naming. Another significant cluster comprises six packages prefixed with z-deno-truth-, with examples like z-deno-truth-va499w, z-deno-truth-ya1t4m, and z-deno-truth-bwhlsz. This prefix suggests an attempt to impersonate or associate with the Deno runtime environment, potentially targeting developers working with Deno-related tools. A third, smaller group of packages, including godxxx, godzz, and godzzz, exhibits a more ad-hoc, possibly typosquatting, naming convention. The simultaneous deployment and rapid disclosure of these varied yet coordinated campaigns underscore a sophisticated and multi-pronged attack strategy, likely designed to maximize the attack surface and complicate detection efforts through diverse naming conventions and potential targeting strategies.
While detailed behavioral findings for each individual package were not extensively provided, the consistent "Critical" severity ratings assigned to many of the disclosed packages, such as @test1230504/string-format-helper and z-deno-truth-va499w, strongly indicate severe compromise potential. Analysis of extracted Indicators of Compromise (IOCs) from the behavioral analysis reveals the domain already-query-bacteria-agreed.trycloudflare.com. This domain is a strong indicator of command-and-control (C2) infrastructure, suggesting that the malicious packages likely attempted to establish covert communication with an external server. Such communication typically serves to exfiltrate sensitive data, download additional malicious payloads, or receive further instructions from the attacker. Other extracted strings, such as fs.readfilesync and http.get, further imply attempts to read local file system contents and initiate arbitrary network requests, which are common tactics employed for data exfiltration, reconnaissance, and remote interaction with compromised systems. The presence of these critical functionalities points to a high risk of unauthorized access and data breach.
The assignment of "Critical" severity to several of these packages signifies that any system that has installed an affected version should be considered fully and irrevocably compromised. This level of compromise typically grants attackers extensive, often root-level, control over the affected environment. The potential consequences are severe, ranging from the theft of sensitive credentials, API keys, and intellectual property to the deployment of ransomware or other destructive malware. Users are unequivocally advised to treat any system that has interacted with these malicious packages as breached. This necessitates an immediate and thorough forensic investigation to ascertain the extent of the compromise, followed by comprehensive remediation steps to secure the environment and prevent further damage.
In light of this coordinated attack, developers and organizations must take immediate action to identify and mitigate potential exposure. The first critical step is to audit all dependency lock files, including package-lock.json, yarn.lock, or pnpm-lock.yaml, for the presence of any of the disclosed package names. If any of these packages are found, they must be promptly removed from all projects and environments. Crucially, all credentials (such as API keys, authentication tokens, and passwords) associated with the compromised development environment, CI/CD pipelines, or any systems that interacted with the malicious packages, should be immediately rotated. This rotation must be performed from a separate, clean, and uncompromised machine to prevent further credential theft. Furthermore, security teams should review their npm token logs for any unauthorized publish events that might indicate a maintainer account compromise, which could be a vector for future attacks. A representative list of affected packages to search for includes:
@test1230504/string-format-helper@test1230504/probe-7f3k2m-utils@test1230504/test-publish-verifyz-deno-truth-va499wz-deno-truth-bwhlszgodxxxhachutishelpersutils-dev-tools
This coordinated disclosure event serves as a stark reminder of the persistent and increasingly sophisticated nature of supply chain attacks targeting popular software package managers like npm. The simultaneous deployment of multiple, distinct campaign signatures within such a tight time window suggests an adversary with significant resources and a deliberate strategy to maximize impact and potentially test various attack vectors or evade pattern-based detection mechanisms. Such concentrated bursts of malicious activity underscore the critical need for continuous vigilance, the implementation of robust dependency scanning tools, and the adoption of proactive security measures throughout the entire software development lifecycle. Organizations must prioritize supply chain security to effectively mitigate the evolving risks posed by malicious packages and safeguard their software ecosystems.