MAL-2026-18610: Malicious code in hushed_zebra_green-81 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.4.2; tarball SHA-256 ffebf73f874c957dd668301a366650064b7e52d0b33aca0943fdd0e1f7d58807.
Affected Software
Event History
Frequently Asked Questions
What must be true for the package to propagate itself?
The package's autopublish.js must be able to run npm publish --access public. The available data does not specify how that script is triggered or what credentials or environment conditions it requires.
How can I determine whether I have the examined malicious package artifact?
Check whether you have hushed_zebra_green-81 version 2.4.2 and compare the tarball SHA-256 to ffebf73f874c957dd668301a366650064b7e52d0b33aca0943fdd0e1f7d58807. Also inspect the package contents for autopublish.js.
What is the practical impact if the publication step succeeds?
The package republishes itself publicly, creating additional copies in the npm registry. This is a propagation mechanism associated with a registry worm and can contribute to registry pollution.