npm: 20 Malicious Packages Disclosed in Under a Minute, Including Scoped Impersonations
Key findings • 20 malicious npm packages were disclosed in a single minute on October 11, 2026. • The burst included multiple packages under specific npm scopes, such as @coopeuch/ and @s4yhi…
Key findings
- 20 malicious npm packages were disclosed in a single minute on October 11, 2026.
- The burst included multiple packages under specific npm scopes, such as
@coopeuch/and@s4yhiitestpoc/. - Many of the malicious packages were newly published, some just 1-2 days before their disclosure.
- All disclosed packages were rated with Critical severity, indicating severe potential system compromise.
- The rapid disclosure points to active monitoring and swift response to supply chain threats.
On October 11, 2026, a coordinated burst of 20 malicious packages was disclosed on the npm registry, all within a single minute. This rapid disclosure, occurring at 15:31 UTC, highlights a swift response to a concentrated attack. Many of these packages were newly published, some appearing on the registry just one or two days before their identification and removal, indicating fresh attempts at supply chain compromise.
While the overall burst did not exhibit a single, overarching naming pattern, closer inspection reveals distinct clusters of malicious activity. A notable pattern involves the use of scoped package names, suggesting attempts to impersonate or target specific organizations. For instance, five packages were published under the @coopeuch/ scope, including core, common, components, config, and button. Similarly, three packages were found under the @s4yhiitestpoc/ scope: r2-https, r3-https, and scan-https-d. These scoped packages, along with others like liferay-workspace-scripts and nested-lib, were designed to blend in or exploit trust associated with legitimate-looking names.
All 20 packages in this burst were assigned a Critical severity rating. While specific behavioral findings for each package were not detailed, a Critical severity typically indicates that the malicious code, if executed, could lead to a complete compromise of the system. This often involves actions such as arbitrary code execution, exfiltration of sensitive data (like environment variables, credentials, or system information), or the establishment of persistent backdoors. Such compromises can grant attackers extensive control over affected development environments or production systems.
The Critical severity assigned to every package in this burst underscores the severe risk posed to any system that may have installed these malicious versions. Developers and organizations are advised to consider any machine that installed these packages as fully compromised. Immediate action should be taken to isolate affected systems, revoke and rotate all credentials, tokens, and keys that may have been exposed, and conduct a thorough forensic analysis from a separate, clean machine.
To mitigate potential impact, developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these dependencies must be removed, and all associated credentials rotated. Specific package names to look for include:
liferay-workspace-scriptsnested-libsome-very-long-package-name@s4yhiitestpoc/r2-https@coopeuch/core
Organizations should also review their npm token logs for any unauthorized publish activity that might indicate a compromised maintainer account.
This rapid, coordinated disclosure of multiple malicious packages, particularly those leveraging scoped names, highlights the ongoing sophistication of software supply chain attacks. The tight time window between publication and disclosure suggests active monitoring and swift response by security teams. However, the sheer volume and diverse naming conventions within such bursts underscore the persistent challenge of identifying and neutralizing these threats before they can impact a wider user base.