Loading story…
A significant surge of auto-generated packages with names following the pattern elf-stats-* was detected on the npm registry, with new variants appearing approximately every two minutes. These packages, often published from newly created accounts, contained simple but potentially harmful code, including scripts that could exfiltrate data or establish reverse shells. Some package descriptions referenced automated generation, capture the flag challenges, or testing, and the rapid publishing cadence matched these claims. The Socket Threat Research Team identified at least 420 unique packages in this campaign, and npm began removing the affected packages as the incident unfolded.
Examples of the malicious code included the use of Node.js child_process.exec to run commands that send encoded directory listings to external servers, and preinstall scripts in package.json designed to open reverse shells. The authors of these packages appeared to have no prior publishing history, suggesting the accounts were created solely for this activity. The incident highlights ongoing risks of supply chain attacks and the need for vigilance in monitoring public package repositories for automated or suspicious uploads.
Trace attribution and downstream blast radius.
3 events from the most recent confirmed update back to the earliest known activity.
npm began taking down affected packages from the repository, though some remained available at the time of reporting. Monitoring and removal efforts were still in progress as new variants and payloads continued to emerge.
Socket Threat Research Team reported detecting over 420 likely malicious or unsafe packages tied to the 'elf-stats' surge, with authors such as 'shadeness' and 'globules67' observed in the campaign. The activity was described as ongoing, with rapid publishing and updates continuing.
A large wave of likely automated npm packages began being published, many using the 'elf-stats-*' naming pattern and descriptions claiming they were generated every two minutes. The packages contained unsafe code including shell command execution and reverse-shell behavior.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale spam campaign has inundated the npm registry with over 46,000 fake packages, many of which use Indonesian names and food terms, and masquerade as Next.js projects. The campaign, active since early 2024, involved the systematic publication of these bogus packages from a small network of npm accounts, with the intent to flood the registry rather than to steal data or execute traditional malware. The packages contain a JavaScript file (such as `auto.js` or `publishScript.js`) that remains dormant unless manually executed, and there is no evidence of automatic execution during installation. Further analysis suggests that the activity is likely the result of an outdated automation script originally tied to a cryptocurrency reward-farming project, rather than an active worm or exploit. The packages, which are mostly copies of a handful of base templates, have minimal download activity and currently pose little risk to users. However, the incident underscores the importance of maintaining strict dependency hygiene and monitoring for suspicious publication patterns in open-source ecosystems like npm.
Jul 12, 2026
Researchers linked a threat actor tracked as **RED-LILI** to a large-scale software supply chain attack that pushed nearly **800 malicious packages** to the **npm** registry in a burst of activity over roughly a week. Checkmarx reported the operation began around February 23, 2022, and relied on a highly automated pipeline that created a separate npm account for each package, complicating bulk detection and takedown efforts. The campaign used custom Python tooling, Selenium, and the open-source **Interactsh** project to automate account creation and bypass npm email one-time-password verification during signup. The malicious packages were part of a broader effort to compromise developers and downstream environments through common package ecosystem abuse techniques, including **typosquatting** and **dependency confusion**. Reporting tied the activity to packages crafted to target organizations such as **Azure, Uber, and Airbnb**, underscoring how attackers can industrialize package publication at scale and turn open-source repositories into an efficient delivery channel for supply chain compromise.
Aug 15, 2026
Multiple malicious npm packages have been discovered targeting developers by employing advanced obfuscation techniques and typosquatting to mimic popular legitimate packages such as *TypeScript*, *discord.js*, *ethers.js*, *nodemon*, and *Claude Code*. Security researchers revealed that these packages use up to four layers of obfuscation—including eval wrapping, XOR encryption, URL encoding, and control flow manipulation—to evade static analysis and conceal credential-stealing malware. The attack chain often begins with deceptive tactics, such as displaying fake CAPTCHAs, and proceeds to exfiltrate sensitive information like IP addresses and credentials to attacker-controlled servers. In one notable case, a package impersonating the official Anthropic CLI was found to proxy commands and data back to the threat actor, enabling both credential theft and remote command execution. These incidents highlight the persistent risks posed by weak validation and oversight in the npm ecosystem, allowing threat actors to publish lookalike packages that are difficult to distinguish from legitimate ones. The sophisticated payloads not only target local developer environments but can also compromise CI/CD pipelines, amplifying the potential impact. Security experts emphasize the need for improved package metadata validation and greater vigilance among developers to mitigate the risk of supply chain attacks through open-source dependencies.
Jun 29, 2026