Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
- Disclosed
- Last updated
- Blast radius
- Unknown scope; version 2.1.0 identified as malicious
- Ecosystems
- Attack vectors
- Affected entities
- blots · 2.1.0
The OpenSSF Package Analysis project identified the npm package 'blots' at version 2.1.0 as malicious. Analysis determined that the package executes one or more commands associated with malicious behavior, indicating active code execution of harmful functionality.\n\nThe malicious package was documented in the OpenSSF's malicious-packages repository under identifier MAL-2026-11158, providing a centralized record for the community.\n\nThis incident was disclosed on 2026-07-29 via GitHub's advisory system (GHSA-m24q-pqxm-qhqw).
Indicators of compromise
- Packages
- blots@2.1.0
Remediation
- Remove blots version 2.1.0 from all environments
- Audit npm dependencies for any installations of blots@2.1.0
- Review package.lock or yarn.lock files to identify affected projects
- Check for any suspicious activity or unauthorized commands executed during the presence of this package
- Update to a safe version of blots if available, or replace with an alternative package
- Monitor systems that may have executed code from this malicious package
Sources
- GitHub Advisory GHSA-m24q-pqxm-qhqw · GitHub Advisory Database
Cite this entry
"Malicious code in blots (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 29, 2026; last updated July 29, 2026. https://supplychainattack.org/incident/malicious-code-in-blots-npm-1ouo6f
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - activecritical
Malware in chain-analyze
Malware discovered in the npm package chain-analyze. Any computer with this package installed or running should be considered fully compromised. All secrets and keys must be rotated immediately from a different computer.
npmCompromised package