MAL-2026-18612: Malicious code in intimate_ostrich_amethyst-45 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 3.1.4; tarball SHA-256 c2602bb843cad68aa7f593fca592887cf660bfcf72e918d1865320c0fed5ec38.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the package to propagate?
The examined package includes autopublish.js, which runs `npm publish --access public`. Propagation requires an environment where that command can publish to npm, such as one with usable npm publishing credentials and permission to publish.
How can I determine whether I have the examined malicious artifact?
Check whether version 3.1.4 of intimate_ostrich_amethyst-45 is present in your dependency or package cache, and compare its tarball SHA-256 to c2602bb843cad68aa7f593fca592887cf660bfcf72e918d1865320c0fed5ec38. Also inspect the package contents for autopublish.js.
What is the immediate concern if this package is installed in a publishing environment?
The package's self-republishing behavior can create additional public npm packages, contributing to registry-worm propagation. Environments with npm credentials capable of publishing are the relevant exposure point.