More than 46,000 counterfeit packages flood NPM
An unprecedented campaign has shaken the JavaScript ecosystem: more than 46,000 fake packages were published on NPM in a matter of days, in what experts consider a large-scale automated attack. The cybersecurity firm Phylum identified that these packages shared naming and structural patterns, with obfuscated scripts that executed malicious code upon installation.
The goal wasn’t to steal credentials directly, but rather to establish persistence and open backdoors on compromised systems. The attackers used evasion techniques such as package names similar to legitimate libraries and structures that mimicked real dependencies. This points to an evolution in typosquatting tactics, where the deception relies on the developer’s familiarity with common names.
What’s most alarming is not just the quantity, but the speed: thousands of posts per hour, suggesting the use of bots and an automated infrastructure to flood the registry. Although NPM has removed many of these packages, the lack of proactive filtering and deeper validations highlights a critical weakness in the software supply chain.
This incident is not isolated. In recent years, the open source ecosystem has been targeted by similar attacks, ranging from the insertion of malware into popular packages to the manipulation of transient dependencies. The difference now is the scale and the automation.
Conclusion: The massive attack on NPM not only exposes technical vulnerabilities but also a governance crisis in open-source repositories. The community must rethink its validation, authentication, and monitoring mechanisms. In an environment where every package can be a gateway, trust can no longer be implicit; it must be verified.
