MAL-2026-18606: Malicious code in colossal_wallaby_pink-87 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 1.2.1; tarball SHA-256 eefa5998b053240ecd251b218193b2352c7dc55759fcaaeeb814f3c5fccf9539.
Affected Software
Event History
Frequently Asked Questions
What must happen for the package to propagate through the registry?
Its included autopublish.js must run in an environment where npm can publish. The propagation action is `npm publish --access public`, which republishes the package publicly.
How can I verify that I have the examined package artifact?
Check for version 1.2.1 and compare the package tarball SHA-256 against eefa5998b053240ecd251b218193b2352c7dc55759fcaaeeb814f3c5fccf9539.
What should I look for when investigating related packages?
Investigate packages with generated names matching the pattern <adjective>_<animal>_<colour>-<number>. The described campaign distributes copies containing the same autopublish.js behavior.