MAL-2026-18622: Malicious code in valid_antlion_amber-50 (npm)
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 4.1.3; tarball SHA-256 9e9bed34eb0cb325419b2806fb984dbe3c4f5e59dfe33519010cdf6cfad3f6eb.
Affected Software
Event History
Frequently Asked Questions
What environment is exposed to the propagation behavior?
The package’s autopublish.js runs npm publish --access public, so exposure requires installing or executing it in an environment with npm available and credentials or configuration that permit publishing to the public npm registry.
What should teams do if they have this package in a dependency or build environment?
Remove the package from dependencies and prevent its scripts from running. Review npm publishing credentials and registry activity for unexpected public publications, particularly packages matching the described generated-name pattern.
How can I confirm I have the examined package artifact?
The examined version is 4.1.3, and its tarball SHA-256 is 9e9bed34eb0cb325419b2806fb984dbe3c4f5e59dfe33519010cdf6cfad3f6eb. The reported propagation code is in autopublish.js.