MAL-2026-18621: Malicious code in unfortunate_crawdad_emerald-79 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 3.3.1; tarball SHA-256 9b1c0d601c4b827fd86f48aff1ab51a397ef52f5ccd42b4b03947234dcc2f891.
Affected Software
Event History
Frequently Asked Questions
What happens if this package is installed or executed?
The examined package contains autopublish.js, which runs `npm publish --access public` to publish the package again. This creates additional public registry copies as part of a self-republishing campaign.
How can I identify the examined malicious artifact?
The examined version is 3.3.1, and its tarball SHA-256 is 9b1c0d601c4b827fd86f48aff1ab51a397ef52f5ccd42b4b03947234dcc2f891. The campaign also uses generated package names following the pattern <adjective>_<animal>_<colour>-<number>.