npm: 40 Malicious Packages, Including '@domyjs' and '@yoannchb' Scopes, Disclosed in 23-Minute Burst
Key findings • 40 malicious npm packages were disclosed on September 5, 2026. • All packages were disclosed within a rapid 23-minute window. • The burst includes packages under the shared…
Key findings
- 40 malicious npm packages were disclosed on September 5, 2026.
- All packages were disclosed within a rapid 23-minute window.
- The burst includes packages under the shared
@domyjsand@yoannchbnpm scopes. - All disclosed packages were assigned a Critical severity rating.
- Many packages were newly published on the day of their disclosure, indicating fresh threats.
On September 5, 2026, 40 malicious packages were disclosed on npm within a 23-minute window (between 19:26 UTC and 19:49 UTC), indicating a coordinated takedown effort. These packages, many of which were published just hours before their disclosure, were consistently flagged with Critical severity. Notably, one package, @domyjs/debounce, had been published over a year prior (July 3, 2025), suggesting a potential maintainer takeover or a long-dormant threat, while the majority were fresh uploads.
The burst exhibits clear signs of coordination, primarily through the use of shared npm scopes. Eight packages were published under the @domyjs scope, including @domyjs/intersect, @domyjs/i18n, @domyjs/reactive, @domyjs/router, @domyjs/mask, @domyjs/throttle, @domyjs/domy, and @domyjs/collapse. Another three packages were found under the @yoannchb scope: @yoannchb/wtf-json, @yoannchb/tokenize, and @yoannchb/langy. The remaining packages appear to be a mix of ad-hoc names, some potentially typosquatting common functionalities, such as fast-html-dom-parser, chrome-speech-recognition, and puppeteer-obscura. Most of these packages had very low download counts, typical for newly introduced malicious software.
While specific behavioral findings from OpenSSF Package Analysis were not publicly detailed for this burst, the consistent 'Critical' severity assigned to all 40 packages indicates that they likely posed a significant threat. Such threats commonly involve remote code execution, credential exfiltration, or other severe forms of system compromise, designed to give attackers control over affected environments or steal sensitive data.
The 'Critical' severity rating for all disclosed packages means that any system that installed these malicious versions should be considered fully compromised. Developers are strongly advised to treat such installations as a severe security incident, requiring immediate action to prevent further damage. This typically involves rotating all credentials and secrets from a separate, clean machine, as well as thorough system audits to identify and eradicate any persistent threats.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all associated credentials (e.g., npm tokens, API keys) should be rotated. Given the nature of supply chain attacks, it is also prudent to review npm audit logs for any unauthorized package publishes if you are a maintainer of any of these packages. A representative list of affected packages includes:
@domyjs/intersect@domyjs/i18n@yoannchb/wtf-jsonfast-html-dom-parserchrome-speech-recognitiontrading-bot-utils
This rapid disclosure of 40 malicious packages within minutes highlights the ongoing challenge of securing software supply chains. The use of distinct scopes alongside seemingly random package names suggests a multi-pronged attack strategy, either by a single actor or a coordinated group, aiming to maximize reach and evade detection. The npm ecosystem continues to be a frequent target for such attacks, underscoring the need for continuous vigilance and robust security practices.