MAL-2026-18620: Malicious code in temporary_smelt_lavender-81 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 3.3.1; tarball SHA-256 3d62a6900cb2eec57c55e599f930c466dcd4ca3539ad7b2ca55779b0fbccba6a.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to trigger the propagation behavior?
The examined package includes autopublish.js that runs `npm publish --access public`. The provided data does not state what execution path invokes that script or whether installing the package alone triggers it.
How can I determine whether I have the examined package artifact?
Check for npm package `temporary_smelt_lavender-81` at version 3.3.1 and compare its tarball SHA-256 with `3d62a6900cb2eec57c55e599f930c466dcd4ca3539ad7b2ca55779b0fbccba6a`.
What is the likely impact if the package publishes successfully?
It republishes itself publicly through npm, creating additional copies as part of a registry-worm propagation campaign. This can fill the registry with replicated packages.