npm: 40 Malicious 'joko-k' Packages Drop in Coordinated Two-Minute Burst

Key findings

• 40 malicious npm packages disclosed.
• All advisories published within a two-minute window on September 13, 2026.
• All packages share the joko-k naming prefix.
• Every advisory was rated with "Critical" severity.
• Many packages were first published 10 months to over 2 years prior to disclosure.

On September 13, 2026, a significant coordinated disclosure event occurred on the npm registry, with 40 malicious packages flagged and removed within a mere two-minute window between 20:14 UTC and 20:16 UTC. This rapid succession of advisories points to a single, concerted takedown effort by security teams targeting a campaign characterized by a distinctive joko-k naming prefix. While many of these packages, such as joko-klanting70-riris and joko-ketoprak70-breki, were relatively low-download, their coordinated nature and critical severity ratings underscore the persistent threat of supply chain attacks. Notably, several packages, like joko-ketoprak70-breki (first published over 2.3 years ago) and joko-ketan92-miaww (first published over 2.4 years ago), had been present on the registry for an extended period, suggesting either long-dormant threats or compromised accounts.

The most striking feature of this burst is the consistent naming convention across all 40 packages. Each package name begins with the joko-k prefix, followed by a word, a number, and then another descriptive word. Examples include joko-klanting70-riris, joko-ketoprak70-breki, joko-keraktelor71-breki, joko-ketan92-miaww, and joko-keripik55-sluey. This highly structured, thematic naming scheme strongly suggests automated generation, a common tactic used by attackers to rapidly deploy numerous malicious packages. The consistency of this pattern across all disclosed advisories confirms the coordinated nature of this campaign, indicating a single actor or group behind the operation. The use of such a pattern allows for easy identification of related malicious components once the signature is recognized.

Unfortunately, the provided advisory details do not include specific behavioral findings from OpenSSF Package Analysis for these packages. Therefore, the precise methods of compromise or exfiltration employed by these malicious packages are not detailed in the public disclosures at this time. However, the consistent "Critical" severity rating across all advisories strongly implies that these packages are designed to perform highly impactful malicious actions upon execution. Without specific behavioral data, it is difficult to ascertain if they communicated with external command-and-control servers or performed other common malicious activities such as credential harvesting or system backdooring.

All 40 packages in this burst were assigned a "Critical" severity rating. This designation is the highest level of severity and typically indicates that any system that installed and executed these packages should be considered fully compromised. Such a compromise means that attackers could gain unauthorized access to sensitive data, execute arbitrary code, or establish persistent control over the affected system. For developers and organizations, this implies a severe security incident requiring immediate and thorough remediation. The critical nature of these vulnerabilities necessitates a comprehensive response to mitigate potential damage.

Given the critical severity of these packages, developers and organizations are strongly advised to take immediate action. The first step is to audit all project dependencies to identify if any of the joko-k prefixed packages were inadvertently installed. This can be done by inspecting package-lock.json or yarn.lock files for the following package names, among others: joko-klanting70-riris joko-ketoprak70-breki joko-keraktelor71-breki joko-ketan92-miaww joko-keripik55-sluey If any of these packages are found, affected systems should be considered compromised. It is imperative to rotate all sensitive credentials (API keys, tokens, passwords) that may have been exposed on the compromised machines, ideally from a separate, clean system. Additionally, organizations should review their npm token logs for any unauthorized publish activities or suspicious access patterns that might indicate a broader compromise of developer accounts. Implementing stricter dependency auditing and supply chain security practices can help prevent similar incidents in the future.

This coordinated burst of 40 malicious npm packages highlights the ongoing challenge of securing the software supply chain. The rapid disclosure within a two-minute window suggests an efficient detection and response mechanism by security researchers and registry maintainers. However, the fact that many of these packages had been present on the registry for months or even years before their disclosure underscores the stealthy nature of some attacks and the potential for long-term exposure. While the specific intent behind this joko-k campaign remains undisclosed, such coordinated drops are a recurring pattern in the threat landscape, often aimed at maximizing reach and impact before detection. This incident serves as a reminder that even seemingly innocuous or low-download packages can be part of a larger, more sophisticated attack strategy.