Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in parallely (npm)

The npm package parallely contains malicious code that impersonates the legitimate concurrently package. When invoked, it executes a dropper that downloads and runs platform-specific payloads after anti-analysis checks.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
All users who installed the malicious parallely package and invoked its concurrently() API or ran its bin commands.
Ecosystems
npm
Attack vectors
Compromised packageTyposquatting
Affected entities
  • parallelyMalicious npm package impersonating concurrently

The npm package parallely was published as a malicious package impersonating the legitimate concurrently library. The package metadata copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and provides bin entries named concurrently and conc to increase the likelihood of installation by users seeking the legitimate package.\n\nThe malicious code is injected into dist/lib/spawn.js within a resolveShell() function that executes whenever the library's concurrently() API is invoked or its command-line binaries are run. The dropper performs anti-analysis checks (Linux /proc TracerPid, Node --inspect/--debug flags, inspector.url()) before proceeding.\n\nUpon execution, the dropper reconstructs an AES-256-GCM decryption key by XOR-combining four base64-encoded blobs, then decrypts a hidden download URL using createDecipheriv() and setAuthTag(). It fetches a platform-specific payload, writes it to os.tmpdir()/ins-/{linux|mac|win.js}, and executes it detached with stdio ignored and windowsHide enabled. The destination host is obfuscated to defeat static analysis.\n\nThe incident was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-11143.

Indicators of compromise

Packages
  • parallely

Remediation

  • Immediately uninstall the parallely package from all systems: npm uninstall parallely
  • Audit npm install logs and package-lock.json to identify when parallely was installed and on which systems
  • Assume any system that installed and executed parallely has been compromised; perform forensic analysis and consider full system remediation
  • Review process execution logs for suspicious child processes spawned from Node.js or npm
  • Check for unexpected files in os.tmpdir()/ins-/ directories on affected systems
  • Update to the legitimate concurrently package if needed: npm install concurrently
  • Implement npm package verification and allowlisting policies to prevent installation of typosquatting packages

Sources

  1. GitHub Advisory GHSA-mxc4-6gh5-wpvw · GitHub Advisory Database

Cite this entry

"Malicious code in parallely (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-parallely-npm-1ca9nx

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in sigchain-js (npm)

    Malicious code was injected into the published npm package sigchain-js, executing arbitrary code on installation via DES-decrypted payloads from companion packages thedata and tchain-api. The attack also involved typosquatting axios to version 1.18.1, which does not exist in legitimate release history.

    npmCompromised packageDependency confusionTyposquatting
  2. resolvedcritical

    Malicious code in rollup-runtime-core-polyfills (npm)

    The npm package rollup-runtime-core-polyfills contained malicious code that impersonated a legitimate rollup polyfill plugin. On every import/require, it decoded and executed a shell command to install an attacker-controlled package (svgcraft-core) and executed code from it, affecting any build system that consumed this package.

    npmCompromised packageTyposquatting
  3. containedcritical

    Malicious code in @ai_/autoprefixers (npm)

    @ai_/autoprefixers is a typosquat of the legitimate autoprefixer package that executes arbitrary attacker-controlled shell commands on installation. The malicious code fetches encrypted payloads from remote C2 servers and decrypts them using a hardcoded key suffix before execution via child_process.exec.

    npmTyposquattingCompromised package
  4. containedcritical

    Malicious code in text-line-parser (npm)

    The npm package text-line-parser contained malicious code in its postinstall.js that collected system information, environment variables (including CI tokens and cloud credentials), and exfiltrated them to a Burp Collaborator domain. The package advertised itself as a text-parsing utility but shipped only stub functions, consistent with a typosquat/decoy supply-chain attack.

    npmCompromised packageTyposquatting