npm: 16 Malicious 'test-dev-' Packages Drop in Coordinated Attack Within One Minute

Key findings

• 16 malicious npm packages disclosed on August 1, 2026
• All advisories published within a single minute
• Packages share the common prefix test-dev-
• All packages were first published approximately 7 days before disclosure
• All packages are rated with Critical severity
• IOCs suggest interaction with Windows system components and script execution

On August 1, 2026, sixteen malicious packages were disclosed on npm within a single minute, all sharing the distinct test-dev- prefix. These packages, first published approximately seven days prior to their disclosure, represent a coordinated effort to inject malicious code into the npm ecosystem.

Campaign Pattern

The campaign is characterized by a clear naming convention, with all packages adopting the test-dev- prefix followed by generic development-related terms. Examples include test-dev-boot, test-dev-host, test-dev-dispatch, test-dev-store, test-dev-watch, test-dev-sync, test-dev-exec, and test-dev-link. This consistent naming suggests an automated or semi-automated process for generating and publishing these malicious artifacts, likely designed to blend in with legitimate development utilities or to target specific development environments. The fact that all these packages were published around the same time, roughly a week before their coordinated disclosure, further points to a deliberate and planned operation.

Malicious Behavior

While specific behavioral findings from OpenSSF Package Analysis were not detailed, the presence of several system-related Indicators of Compromise (IOCs) suggests the malware aims to interact with or execute within a host system. These IOCs include references to common Windows executables and libraries such as chrome.exe, wscript.exe, and user32.dll, as well as script files like launcher.vbs, extproc.js, runtime.js, and utils.js. This pattern implies the malicious packages are designed to execute scripts or interact with core system components, potentially to achieve persistence, exfiltrate data, or perform other unauthorized actions on affected machines.

Severity and Impact

All disclosed packages have been assigned a Critical severity rating. This indicates that any system that installed these malicious packages should be considered fully compromised. The nature of such compromises often means an attacker could gain unauthorized access to sensitive information, execute arbitrary code, or establish persistent control over the affected environment. Users are strongly advised to treat any system that installed these packages as compromised and take immediate remediation steps.

Detection and Response

Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any packages beginning with the test-dev- prefix. If found, these packages must be removed, and all credentials, tokens, and sensitive data associated with the compromised development environment should be rotated from a separate, clean machine. It is also crucial to review npm token logs for any unauthorized publish activity. Specific package names to look for include:

• test-dev-boot
• test-dev-host
• test-dev-dispatch
• test-dev-store
• test-dev-watch
• test-dev-sync
• test-dev-exec
• test-dev-link

Broader Context

This coordinated burst of malicious package disclosures highlights the ongoing threat of supply chain attacks targeting popular package managers like npm. The rapid, synchronized publication and subsequent disclosure of these packages underscore the sophistication of threat actors who leverage automated methods to distribute malware. While the exact intent behind this specific campaign remains unclear without further analysis of the malicious payloads, the consistent naming scheme and tight disclosure window point to a single, organized operation aimed at compromising developer environments.