Malicious code in @depup/astro (npm)
@depup/astro is a malicious npm package that impersonates the legitimate Astro framework by spoofing author and repository metadata, while systematically replacing well-known dependencies with lookalike packages under different maintainers. The package source code was rewritten to import from these lookalike packages, causing normal npm installs to execute attacker-controlled code instead of legitimate upstream dependencies.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed @depup/astro and its lookalike transitive dependencies
- Ecosystems
- Attack vectors
- Affected entities
- @depup/astroMalicious package impersonating astro framework with substituted dependencies
- piccoloreLookalike for picocolors
- obugLookalike for debug
- @astrojs/markdown-satteriLookalike for @astrojs/markdown-remark
- tinyclipAtypical lookalike dependency
- am-i-vibingAtypical lookalike dependency
- fontaceAtypical lookalike dependency
@depup/astro is a malicious npm package published under the @depup scope that impersonates the legitimate Astro framework. The package.json falsely sets the author to 'withastro' and the repository to github.com/withastro/astro, presenting itself as a routine dependency-bump update.\n\nThe attack systematically replaces well-known Astro dependencies with lookalike packages controlled by different maintainers: picocolors→piccolore (^0.1.3), debug→obug (^2.1.4), and @astrojs/markdown-remark→@astrojs/markdown-satteri (0.3.5), alongside other atypical names such as tinyclip, am-i-vibing, and fontace. The shipped source code has been mass-rewritten to import from these lookalike packages (e.g., import colors from \"piccolore\" instead of picocolors).\n\nA normal npm install and subsequent build resolves and executes code from the attacker-controlled lookalike packages rather than the genuine upstream dependencies. The advertised version numbers (astro 7.2.0, vite 8, esbuild 0.28, zod 4) do not correspond to real upstream releases. README keywords like 'security', 'latest', and 'patched' are used to normalize the substitutions as a maintenance update.\n\nThe incident was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-13622."
Indicators of compromise
- Packages
- @depup/astro
- piccolore
- obug
- @astrojs/markdown-satteri
- tinyclip
- am-i-vibing
- fontace
Remediation
- Remove @depup/astro and all associated lookalike packages (piccolore, obug, @astrojs/markdown-satteri, tinyclip, am-i-vibing, fontace) from your project
- Audit your npm install history and any systems that may have executed code from @depup/astro
- Reinstall legitimate dependencies from the official upstream sources (astro, picocolors, debug, @astrojs/markdown-remark, etc.)
- Review npm audit logs and consider rotating any credentials or secrets that may have been exposed
- Monitor for suspicious activity on systems where @depup/astro was installed
- Use npm package verification tools and check package.json for unexpected or unfamiliar dependencies
Sources
- GitHub Advisory GHSA-6pqf-9w43-mrp4 · GitHub Advisory Database
Cite this entry
"Malicious code in @depup/astro (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-depup-astro-npm-1btgnz
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion - resolvedcritical
Malicious code in cspell-esm (npm)
cspell-esm, a typosquatting package on npm resembling the legitimate 'cspell' library, contained malicious code delivered through a smuggled off-registry dependency (ltidisafe) hosted on a Google Cloud Storage bucket. Installation triggered execution of lifecycle scripts and code from the attacker-controlled dependency.
npmCompromised packageTyposquattingDependency confusion - resolvedcritical
Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)
The npm package tinkoff-statist-browser-typed-client-sme.compliance.web.events contains malicious code that downloads and executes platform-specific binary payloads on require. The package name mimics an internal Tinkoff namespace to evade detection and uses DNS TXT covert channels as a fallback delivery mechanism.
npmCompromised packageTyposquattingDependency confusion