npm: 19 Malicious Packages Disclosed in 26-Minute Burst
Key findings • 19 malicious npm packages were disclosed within a 26-minute window on November 2, 2026. • Many packages were published just hours before their disclosure, indicating a rapid de…
Key findings
- 19 malicious npm packages were disclosed within a 26-minute window on November 2, 2026.
- Many packages were published just hours before their disclosure, indicating a rapid deployment strategy.
- Malicious behaviors include communication with suspicious domains and command execution.
- All disclosed packages were rated as Critical severity.
On November 2, 2026, nineteen malicious packages were disclosed on npm within a 26-minute window, from 06:05 UTC to 06:31 UTC. This rapid succession of disclosures points to a coordinated campaign, with many of the packages being newly published just hours before their detection and removal.
While no single naming pattern or scope ties these packages together, a significant number were published on the same day they were disclosed, suggesting they were purpose-built for this campaign. For instance, ms-client-portal, sol-wallet-adapter, axelarjs-sdk, and calculator-preinstall-hook-demo were all first published on November 2, 2026, mere hours before being flagged as malicious. Other packages like scdn-jquery had a slightly longer lifespan, being published 10 days prior.
Analysis of the disclosed packages reveals common malicious behaviors. Several packages, including sol-wallet-adapter and calculator-preinstall-chain-demo, were found to communicate with domains associated with malicious activity. Another package, dependencykfee-2, was observed executing commands, a common tactic for establishing persistence or exfiltrating sensitive data from compromised systems.
The severity of these disclosures is critical. As with many supply chain attacks, any system that installed these malicious packages should be considered fully compromised. Users are advised to rotate all credentials and secrets from a separate, clean machine, as the malware may have exfiltrated sensitive information such as API keys, tokens, or environment variables.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all credentials used in the affected environment should be rotated. Examples of packages to look for include sol-wallet-adapter, dependencykfee-2, scdn-jquery, ms-client-portal, and calculator-preinstall-hook-demo.
This burst of 19 malicious npm packages within a short timeframe highlights the ongoing threat of supply chain attacks. The rapid deployment and subsequent disclosure of these packages underscore the need for continuous vigilance and robust security practices in software development ecosystems.