MAL-2026-18619: Malicious code in specific_sheep_violet-22 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.4.1; tarball SHA-256 3f547db278b249244788b7b77fef67286b74bf08baf45514c6d2480fa1671ce7.
Affected Software
Event History
Frequently Asked Questions
What must happen for the package to propagate?
Its autopublish.js must run in an environment where npm can execute `npm publish --access public`. That publication step creates another public copy as part of the self-republishing campaign.
How can I identify the examined malicious artifact?
The examined version is 2.4.1. Its tarball SHA-256 is 3f547db278b249244788b7b77fef67286b74bf08baf45514c6d2480fa1671ce7.
What related packages should be investigated?
Investigate packages with generated names following the pattern `<adjective>_<animal>_<colour>-<number>`. The campaign is described as publishing packages that ship the same autopublish.js behavior.