npm: 40 Malicious Packages Disclosed in 3-Minute Window

Key findings

• 40 malicious npm packages were disclosed on September 4, 2026.
• All advisories were published within a tight three-minute window.
• Packages exhibited varied naming conventions, without a single clear pattern.
• All disclosed packages were assigned a 'Critical' severity rating.
• Impacted systems should be considered fully compromised, requiring credential rotation.

On September 4, 2026, 40 malicious npm packages were disclosed within a tight three-minute window, all flagged with Critical severity. This rapid succession of advisories, published between 07:15 UTC and 07:17 UTC, strongly suggests a coordinated takedown effort by security researchers or the npm registry team.

Unlike many coordinated campaigns that exhibit clear naming patterns or shared scopes, this burst of 40 packages appears to consist of more ad-hoc or varied names. While some packages share prefixes like damp_ (e.g., damp_hippopotamus_z3n, damp_pelican_z3n, damp_hawk_0xrequest) or dandelion- (e.g., dandelion-dune-cli341-project, dandelion-giraffe-mpa122-project), others are unique or follow different conventions, such as danasah, dampradio, daliusheng-tongjie-zhong, and daliuren-zhinan. This lack of a single, overarching naming convention could indicate a diverse set of origins or a deliberate attempt to obscure a common source.

All 40 disclosed packages were assigned a 'Critical' severity rating. While specific behavioral findings from OpenSSF Package Analysis were not detailed in the advisories, this highest severity level typically indicates that the packages are designed to perform highly destructive or compromising actions. This can include, but is not limited to, arbitrary code execution, credential theft, or the establishment of persistent backdoors. The absence of detailed behavioral reports for this specific burst means the exact mechanisms of compromise are not publicly detailed in these advisories.

A Critical severity rating means that any system that installed these malicious packages should be considered fully compromised. Developers are strongly advised to treat such an incident with the utmost urgency. The potential impact ranges from data exfiltration and unauthorized access to the complete takeover of development environments or production systems. It is crucial to assume that all secrets, credentials, and sensitive data accessible from the compromised environment may have been exposed.

Developers should immediately audit their package-lock.json or yarn.lock files for any of the disclosed package names. If any are found, the affected systems must be isolated, and all credentials (API keys, tokens, passwords) that were present or used on those systems should be rotated from a separate, clean machine. Additionally, review any logs for unusual outbound network connections or unauthorized package publishes. A representative list of some of the malicious packages includes: damp_hippopotamus_z3n dandelion-dune-cli341-project damp_hawk_0xrequest danasah dampradio

This rapid disclosure of 40 malicious packages within minutes highlights the ongoing vigilance required in the software supply chain. While the lack of a clear naming pattern makes it difficult to attribute to a single, easily identifiable campaign, the tight disclosure window suggests a concerted effort by security teams to identify and remove these threats from the npm registry. Such bursts underscore the dynamic nature of attacks targeting package ecosystems and the continuous need for robust security practices.