npm: 11 Malicious Packages Disclosed in Under a Minute
Key findings • 11 malicious npm packages were disclosed on September 1, 2026. • All advisories were published within a single minute. • All packages were first published just 12 hours bef…
Key findings
- 11 malicious npm packages were disclosed on September 1, 2026.
- All advisories were published within a single minute.
- All packages were first published just 12 hours before disclosure.
- Every package was assigned a Critical severity rating.
- Package names suggest a focus on web3 and blockchain development.
- Affected packages include
fuels-forc,generate-schema-ethers, andnpx-oob-package.
On September 1, 2026, 11 malicious npm packages were simultaneously disclosed, all within a single minute, indicating a highly coordinated supply chain attack. These packages, all first published just 12 hours prior to their disclosure, were quickly identified and removed from the npm registry.
While no single overarching naming convention like a shared scope or prefix was identified, the package names suggest an attempt to target or impersonate libraries related to blockchain and web3 development. Examples include fuels-forc, fuels-versions, fuels-core, generate-schema-ethers, generate-schema-viem, verify-contract-viem, and verify-contract-ethers. The rapid publication and disclosure, coupled with the thematic naming, point to a deliberate and focused attack.
Although specific behavioral findings from OpenSSF Package Analysis were not detailed in the advisories, the consistent 'Critical' severity assigned to all 11 packages strongly implies severe compromise capabilities. Typically, such critical vulnerabilities in malicious packages can lead to arbitrary code execution, sensitive data exfiltration, or complete system takeover on affected machines.
The critical severity rating means that any system that installed these packages should be considered fully compromised. Users are advised to treat any machine that may have executed these packages as untrusted, necessitating immediate action to prevent further damage. This includes rotating all credentials, API keys, and other sensitive information from a separate, secure machine.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the following malicious packages:
fuels-forcfuels-versionsfuels-coreverify-contract-viemgenerate-schema-ethersgenerate-schema-viemverify-contract-ethersfuels-typegencre-setuphyperliquid-composernpx-oob-package
If found, these packages must be removed, and all associated credentials and secrets rotated. Additionally, organizations should review npm token logs for any unauthorized publish activities.
This incident highlights the ongoing threat of rapid-fire malicious package drops designed to quickly infiltrate development environments. The short lifespan of these packages—published and disclosed within hours—underscores the need for continuous monitoring and rapid response mechanisms within the software supply chain.