MAL-2026-18613: Malicious code in itchy_gecko_magenta-98 (npm)
Published Nov 2, 2026
·Updated
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.3.4; tarball SHA-256 ce54dc3b5212e9e3c4ea35938e592aeba77d0683479bb3b4d9cb0d254ae97fb5.
Affected Software
1 affected component
npm/itchy_gecko_magenta-98=2.3.4
Event History
Nov 2, 2026
Advisory Published
via OSV·09:44 AM
Data Sourced
via OSV·09:44 AM
DescriptionAffected Software
Frequently Asked Questions
1
What action does the malicious package perform when it runs?
It includes autopublish.js, which executes `npm publish --access public` to publish the package again. This self-republishing behavior propagates copies through the npm registry.
2
Which artifact was examined for this finding?
The examined version was 2.3.4. Its tarball SHA-256 is ce54dc3b5212e9e3c4ea35938e592aeba77d0683479bb3b4d9cb0d254ae97fb5.