npm: Malicious 'simple-date-formatter-new' Series Among 10 Packages Dropped in 2-Minute Burst
Key findings • Ten malicious npm packages were disclosed on September 24, 2026. • All disclosures occurred within a tight two-minute window, indicating coordination. • The burst included …
Key findings
- Ten malicious npm packages were disclosed on September 24, 2026.
- All disclosures occurred within a tight two-minute window, indicating coordination.
- The burst included a series of similarly named packages like
simple-date-formatter-new-XX. - Several packages were newly published just 1-3 days before their disclosure.
- Affected systems should be considered fully compromised, requiring credential rotation and system audits.
On September 24, 2026, ten malicious packages were disclosed on the npm registry within a two-minute window, from 13:15 UTC to 13:18 UTC. This rapid succession of advisories strongly suggests a coordinated malicious campaign or a swift takedown effort by security teams.
The disclosed packages exhibit several patterns indicative of a campaign. A prominent series of packages, such as simple-date-formatter-new-11, simple-date-formatter-new-13, simple-date-formatter-new-14, simple-date-formatter-new-15, and simple-date-formatter-new-16, were all published with version 1.0.0 and disclosed within seconds of each other. This naming convention often points to automated generation or a concerted effort to flood the registry. Additionally, packages like aliftech-ui (version 99.9.9) and @birbalo/aliftech-ui (version 99.9.9) share a similar name and version, suggesting either typosquatting or an attempt to impersonate a legitimate project. Other packages like @osl-design/react (version 9.9.10) and @nf-addons/am-global-header (version 9.9.10) also share identical version numbers, further hinting at a common origin or deployment strategy. Notably, several of these packages, including eslint-config-compact-base, @osl-design/react, and @nf-addons/am-global-header, were first published just 1 to 3 days before their disclosure, indicating they were fresh additions to the registry likely created specifically for this malicious activity.
While specific behavioral findings were not detailed in the provided advisories, the coordinated nature of these disclosures implies that the packages were designed to perform malicious actions. In general, such packages often aim to exfiltrate sensitive information, establish persistence on compromised systems, or execute arbitrary code. The lack of detailed behavioral reports means users should exercise extreme caution.
The severity of installing any malicious package cannot be overstated. If any of these packages were installed, the affected system should be considered fully compromised. This means that all secrets, credentials, and sensitive data on that machine could have been accessed or exfiltrated. The standard recommendation in such scenarios is to rotate all credentials from a separate, clean machine and to thoroughly audit the compromised environment for any unauthorized changes or persistent threats.
Developers should immediately audit their package-lock.json or yarn.lock files for the presence of any of the disclosed malicious packages. If found, these packages must be removed, and all associated credentials, especially npm tokens, should be rotated. It is also advisable to review npm token logs for any unauthorized publish activities. A representative list of the affected package names includes: simple-date-formatter-new-16 eslint-config-compact-base aliftech-ui @osl-design/react @birbalo/aliftech-ui This burst of disclosures highlights the ongoing challenge of maintaining supply chain security in package ecosystems. The rapid deployment and subsequent takedown of these packages underscore the continuous cat-and-mouse game between malicious actors and security researchers, emphasizing the need for vigilance and robust security practices in software development workflows.