npm: 23 Malicious Packages Under '@wethenorth12' Scope Drop in 10-Minute Burst
Key findings • 33 malicious npm packages disclosed within a 10-minute window on August 5, 2026. • 23 packages shared the @wethenorth12 npm scope, indicating a coordinated campaign. • Pack…
Key findings
- 33 malicious npm packages disclosed within a 10-minute window on August 5, 2026.
- 23 packages shared the
@wethenorth12npm scope, indicating a coordinated campaign. - Packages impersonated cryptocurrency libraries and utilities, likely targeting wallet credentials.
- IOCs suggest communication with external services for data exfiltration.
- Affected systems should be considered fully compromised, requiring immediate credential rotation.
On August 5, 2026, 33 malicious packages were disclosed on the npm registry within a tight 10-minute window, from 06:16 UTC to 06:26 UTC. A significant portion of these, 23 packages, were published under the @wethenorth12 npm scope, strongly suggesting a coordinated campaign targeting the JavaScript ecosystem. The rapid disclosure of these packages indicates a swift response to an active threat.
The primary signature of this campaign is the extensive use of the @wethenorth12 npm scope, under which 23 distinct malicious packages were published. These packages often mimic popular cryptocurrency, blockchain, and wallet-related libraries, such as @wethenorth12/etherjs, @wethenorth12/solana-web3, @wethenorth12/bip39-generator, @wethenorth12/bitcoin-lib, and @wethenorth12/ethers-wallet. This naming convention aims to trick developers into installing seemingly legitimate, yet compromised, versions of essential tools. Beyond this dominant scope, other packages in the burst, like bip32-js, python-bitcoinlib, mnemonic-utils, ethereum-sign-utils, and ethers-lib, also exhibit names related to blockchain and cryptocurrency utilities, reinforcing the coordinated nature and thematic focus of this attack.
While detailed behavioral findings for each package were not explicitly provided, the consistent naming patterns and the nature of the targeted functionalities strongly imply that these packages are designed for credential harvesting and data exfiltration. Extracted Indicators of Compromise (IOCs) from the advisories include domains such as 1rpc.io, api.telegram.org, eth-mainnet.public.blastapi, ethereum-rpc.publicnode.com, and fiora.nixel.my. The presence of these domains suggests that the malicious code attempts to communicate with external services, likely to transmit stolen cryptocurrency wallet keys, seed phrases, private keys, or other sensitive user data to attacker-controlled infrastructure. Given the focus on blockchain and wallet libraries, the primary objective is almost certainly financial gain through unauthorized access to digital assets.
The compromise resulting from the installation of any of these malicious packages is severe. Any development environment or production system where these packages were introduced should be considered fully compromised. Attackers could gain deep access, potentially leading to the exfiltration of sensitive data, unauthorized code execution, or further lateral movement within an organization's network. Users are strongly advised to treat such an incident with the highest priority, immediately rotating all secrets, API keys, and credentials from a separate, clean machine that has not been exposed to the compromised packages. Furthermore, a thorough forensic analysis of affected systems is recommended to ascertain the full extent of the breach.
Developers should immediately audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all associated credentials rotated. Specific package names to look for include:
@wethenorth12/etherjs@wethenorth12/solana-web3bip32-jsethereum-sign-utilsethers-lib
Organizations should also review their npm token logs for any unauthorized publish events and implement stricter access controls for their package registries.
This coordinated burst underscores the persistent threat of software supply chain attacks, particularly those leveraging brand impersonation and typosquatting within critical ecosystems like npm. The focus on cryptocurrency-related packages highlights a lucrative target for malicious actors, who continuously adapt their tactics to exploit developer trust and the interconnected nature of modern software development. Such rapid, thematic drops demonstrate the need for continuous vigilance, robust automated scanning, and prompt incident response mechanisms to protect the integrity of the software supply chain.