MAL-2026-18623: Malicious code in xenacious_kangaroo_blush-47 (npm)
Published Nov 2, 2026
·Updated
Part of a self-republishing campaign: generated names of the form <adjective><animal><colour>-<number>, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 4.3.3; tarball SHA-256 d3d633c35cdfcf07a34516e2f1d6a1761c15d4e5b0769b0fb55117520cc90225.
Affected Software
1 affected component
npm/xenacious_kangaroo_blush-47=4.3.3
Event History
Nov 2, 2026
Advisory Published
via OSV·09:44 AM
Data Sourced
via OSV·09:44 AM
DescriptionAffected Software
Frequently Asked Questions
1
How can I identify the examined package artifact?
The examined artifact is version 4.3.3 of xenacious_kangaroo_blush-47. Its tarball SHA-256 is d3d633c35cdfcf07a34516e2f1d6a1761c15d4e5b0769b0fb55117520cc90225.