On the evening of November 3, 2026, someone published six new versions of four npm packages whose last regular releases date from 2018 to 2021. Each release carries a hidden loader that looks up its server’s address in Ethereum transactions, then downloads more code and runs it in memory.
The releases were caught by Greenflagged, a private npm registry that only serves packages that pass its review. Its write-up by Sean Madden is, at the time of writing, the only detailed analysis.
Source: Privacy Affairs · 2026-11-04