MAL-2026-18615: Malicious code in pure_opossum_amaranth-54 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.3.2; tarball SHA-256 0fe7b3d8ed7ec429ff5f53971bb933640ddb717f2dd39621a5d435b7664ac18a.
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this package?
Systems that install or otherwise execute code from the npm package pure_opossum_amaranth-54 are exposed to its self-publication behavior. The examined version is 2.3.2.
What does the malicious code need to propagate?
The included autopublish.js runs npm publish --access public. Propagation therefore depends on an environment where that command can publish the package to the npm registry.
How can I determine whether I have the examined malicious artifact?
Check whether pure_opossum_amaranth-54 version 2.3.2 is present in your npm dependencies or package cache, and compare the tarball SHA-256 to 0fe7b3d8ed7ec429ff5f53971bb933640ddb717f2dd39621a5d435b7664ac18a. Inspect the package contents for autopublish.js.