MAL-2026-18609: Malicious code in hollow_wildebeest_silver-94 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 1.1.2; tarball SHA-256 01f53d63acbd1e1c1275a099ac442ab52446e4fa180395088fd49c7a168f193c.
Affected Software
Event History
Frequently Asked Questions
What behavior makes this package dangerous in an npm environment?
The examined package contains autopublish.js, which runs `npm publish --access public` to publish the package again. This self-republishing behavior propagates copies through the npm registry and can contribute to registry-worm activity.
Which artifact was examined for this finding?
The examined version was 1.1.2. Its tarball SHA-256 is 01f53d63acbd1e1c1275a099ac442ab52446e4fa180395088fd49c7a168f193c.