MAL-2026-18614: Malicious code in motionless_mandrill_blush-51 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.2.3; tarball SHA-256 b524996b7179cbc2702ad62f3d2917241f9cf8ad5d559202eac825ebd7cd9844.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the package to propagate?
The examined package includes autopublish.js that runs `npm publish --access public`. Propagation therefore requires execution of that code in an environment able to run npm publishing with credentials and permissions to publish publicly.
How can I identify the examined malicious artifact?
The examined version is 2.2.3. Its tarball SHA-256 is b524996b7179cbc2702ad62f3d2917241f9cf8ad5d559202eac825ebd7cd9844.
What should I look for when investigating related packages?
The campaign uses generated package names matching the pattern <adjective>_<animal>_<colour>-<number>. Related packages are described as shipping the same autopublish.js self-publication behavior.