MAL-2026-18618: Malicious code in southern_duck_tan-16 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.4.3; tarball SHA-256 a3154921b8a06cfa66c41cf8d689a9e16610ddda9e78c8db51e986bcf1e056d9.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for the package to propagate through npm?
The included autopublish.js runs `npm publish --access public`. Propagation therefore requires an environment where that command can publish the package to npm, such as one with usable npm publishing credentials and permission to create a public package.
How can I determine whether I have the examined malicious artifact?
Check whether your dependency cache, build artifacts, or downloaded tarball contains southern_duck_tan-16 version 2.4.3. The examined tarball has SHA-256 a3154921b8a06cfa66c41cf8d689a9e16610ddda9e78c8db51e986bcf1e056d9.
What should I do if this package is present and cannot immediately be removed?
Prevent npm publication from the affected environment by removing or disabling npm publishing credentials and permissions. This addresses the documented propagation behavior, which relies on running `npm publish --access public`.