npm: 11 Malicious Packages with '-auth' Suffix Disclosed in Coordinated 36-Minute Drop
Key findings • 11 malicious npm packages disclosed within a 36-minute window on September 18, 2026. • Eight packages shared the common '-auth' suffix, indicating a naming campaign. • All …
Key findings
- 11 malicious npm packages disclosed within a 36-minute window on September 18, 2026.
- Eight packages shared the common '-auth' suffix, indicating a naming campaign.
- All packages were first published just hours before their disclosure.
- Malware communicated with
oastify.comdomains for C2 and data exfiltration. - Packages were capable of executing arbitrary commands on affected systems.
- Multiple advisories received Critical severity ratings.
On September 18, 2026, 11 malicious npm packages were disclosed within a 36-minute window, from 15:26 UTC to 16:01 UTC. This rapid succession of advisories points to a coordinated supply chain attack, with a significant portion of the packages exhibiting a common naming pattern. All identified packages were first published on the same day, just hours before their disclosure, indicating they were purpose-built for this malicious activity and quickly identified by security researchers.
The campaign primarily leveraged a common naming convention, with eight of the eleven packages sharing the -auth suffix. These packages, such as test899-auth, test89-auth, test8999-auth, and test890-auth, appear to be part of a series of generic-sounding names, potentially indicating automated generation or a broad attempt at typosquatting or brandjacking. The tight publication and disclosure window for these packages further reinforces the coordinated nature of their release. The burst also included openmct-heatmap and @shared-web/assets, which, while not sharing the -auth suffix, were disclosed within the same narrow timeframe, suggesting they are part of the same coordinated takedown effort.
Behavioral analysis from OpenSSF Package Analysis revealed that at least two of the packages, test8999-auth and test899-auth, were designed to communicate with external domains associated with malicious activity and execute arbitrary commands. Specifically, these packages were observed attempting to connect to oastify.com subdomains such as dfwstre3dgnrhwm2bvkczgucc3iv6lua.oastify.com and hufw8vt7sk2vw016qzzgek9gr7x0ls9h.oastify.com. These domains are commonly used for out-of-band data exfiltration or command-and-control, allowing attackers to potentially compromise systems that installed these packages by stealing sensitive information or gaining remote access.
The critical severity ratings assigned to multiple advisories underscore the severe risk posed by this type of attack. Any system that installed these packages should be considered fully compromised. The malware's command execution capabilities could lead to complete system takeover, making it imperative for affected users to take immediate and decisive action. Users are advised to immediately rotate all credentials and sensitive information from a separate, clean machine, as the integrity of the compromised system cannot be guaranteed.
Developers should immediately audit their project dependencies, specifically checking package-lock.json or yarn.lock files for the presence of any of the following malicious packages: `
- test899-auth
- test89-auth
- test8999-auth
- test890-auth
- openmct-heatmap
- @shared-web/assets
` If found, these packages must be removed, and all credentials (including npm tokens, API keys, and other sensitive data) associated with the affected development environment should be rotated from a secure, uncompromised system. Additionally, review npm audit logs for any unauthorized package publishes or suspicious activity to identify potential breaches of developer accounts.
This coordinated disclosure highlights the ongoing threat of supply chain attacks targeting package ecosystems like npm. The rapid deployment and subsequent disclosure of these packages within such a short timeframe demonstrate both the agility of attackers in attempting to inject malicious code and the effectiveness of security teams in identifying and removing malicious content. Such bursts are a recurring pattern in the software supply chain landscape, emphasizing the critical need for continuous vigilance, robust security practices, and proactive monitoring in software development workflows to mitigate risks effectively.