npm: 40 Malicious Packages in 'leda-' Campaign Drop Within One Minute
Key findings • 40 malicious npm packages disclosed on September 17, 2026. • All advisories published within a single minute (08:17 UTC). • 39 packages share the distinctive leda- naming p…
Key findings
- 40 malicious npm packages disclosed on September 17, 2026.
- All advisories published within a single minute (08:17 UTC).
- 39 packages share the distinctive
leda-naming prefix. - All disclosed advisories were assigned a Critical severity rating.
- Many packages were first published over two years ago, suggesting potential account takeovers.
On September 17, 2026, 40 malicious packages were disclosed on the npm registry within a single minute, all advisories published precisely at 08:17 UTC. This rapid, coordinated disclosure points to a concerted effort to distribute malicious code, with 39 of these packages sharing a distinctive leda- prefix in their names. Many of the leda- prefixed packages, such as leda-javascript-stream-husky (first published 2.2 years ago) and leda-koa-dotenv-safe-atlas (first published 2.3 years ago), were initially published over two years ago. This longevity, coupled with low download counts, suggests these might be dormant packages that were either taken over or weaponized long after their initial creation. The package lectron, also disclosed in the same minute, had an even longer history, first published over five years ago.
Campaign Pattern
The most striking pattern among the disclosed packages is the pervasive leda- prefix, shared by 39 out of the 40 malicious entries. This consistent naming convention strongly suggests a deliberate campaign rather than isolated incidents. Examples include leda-jsonp-dependencies-eslint-config, leda-loopback-markdown-pdf-quasar, leda-nodejs-nextjs-sirius, leda-miranda-oberon-capella, and leda-npm-chai-sync. The names themselves appear to be a mix of common programming terms, celestial bodies, and random strings, potentially designed to evade detection or impersonate legitimate, albeit obscure, dependencies.
Malicious Behavior
While specific behavioral findings for this burst were not detailed in the advisories, the nature of such supply chain attacks typically involves attempts to exfiltrate sensitive information, inject backdoors, or establish persistent access to compromised systems. Malicious npm packages often achieve this by executing arbitrary code during installation or when imported by a project, leveraging postinstall scripts or obfuscated JavaScript. Without specific details, it is prudent to assume the worst-case scenario regarding potential impact.
Critical Severity
All 40 advisories were rated 'Critical' severity, underscoring the severe risk posed to any system that installed these packages. A critical severity rating implies that a successful exploit could lead to full system compromise, allowing attackers to gain complete control over the affected environment. This often necessitates treating any machine that installed such a package as fully compromised, requiring immediate action such as rotating all credentials and secrets from a separate, secure machine.
Detection and Response
Developers and organizations are strongly advised to audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for the presence of any of these malicious packages. If found, immediate steps should include removing the dependency, rotating all associated credentials (API keys, tokens, passwords), and thoroughly checking for any unauthorized activity or persistent backdoors. A representative list of affected packages includes:
leda-jsonp-dependencies-eslint-configleda-javascript-stream-huskyleda-loopback-markdown-pdf-quasarleda-morgan-xanthus-ophiuchusleda-koa-dotenv-safe-atlaslectron
Broader Context
This burst of 40 malicious npm packages within a single minute highlights the ongoing and evolving threat of software supply chain attacks. The use of a consistent naming prefix, combined with the rapid, synchronized disclosure, suggests a sophisticated and coordinated effort by threat actors. While the specific intent behind this particular campaign remains undisclosed, such incidents serve as a stark reminder of the need for continuous vigilance, robust dependency scanning, and proactive security measures in modern software development workflows.