Supply chain · npm · High

Malicious npm package 'far-jade-porcupine' pollutes registry, impacts build integrity

Threat Engine Auto-Feed · data current as of 2026-09-10

The npm package 'far-jade-porcupine' contains malicious code designed to automatically generate and publish derivative packages with randomized names, polluting the npm registry. While primarily focused on inflating developer reputation scores, its presence indicates a compromise of package integrity and could affect build processes.

  • Package: npm / far-jade-porcupine
  • Affected versions: > 0
  • Severity: critical
  • Reach: ~1/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'far-jade-porcupine' was found to contain malicious code. This code modifies the package.json file, specifically removing private flags and changing version numbers. It then generates new packages with randomized names, often Indonesian-themed, and continuously republishes these variants to the npm registry.

How the attack works

This attack involves the distribution of a malicious software package within a public registry. When installed, the package executes scripts that manipulate its own metadata and then automatically publishes new, similarly named packages. This process aims to inflate metrics or pollute the registry, potentially impacting the reliability and security of the package ecosystem.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest package versions
  • Teams that do not vet third-party package dependencies

Conditions that increase exposure

  • Direct or transitive dependency on 'far-jade-porcupine'
  • Lack of package lockfiles (e.g., package-lock.json) to ensure consistent dependency versions
  • Automated build processes that do not scan for known malicious packages
  • Use of internal package mirrors that do not filter out known malicious packages

Blast-radius scenarios

  • An attacker successfully leverages the package to pollute the npm registry, potentially leading to confusion or supply chain attacks against other users.
  • The malicious package's execution within a build environment could lead to unexpected modifications of build artifacts or metadata.
  • While the primary goal appears to be registry pollution, the ability to modify package.json could be a precursor to more severe supply chain attacks.

What to do (defensive)

Detect

  • Scan dependency trees for 'far-jade-porcupine' or any of its randomized variants.
  • Monitor build logs for unexpected package publishing activity or modifications to package.json files.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages in your dependencies.

Contain

  • Immediately remove 'far-jade-porcupine' from all project dependencies.
  • Block 'far-jade-porcupine' and any known variants at the network or registry level.
  • Isolate any build environments where 'far-jade-porcupine' was installed to prevent further spread or registry pollution.

Remediate

  • Audit all projects that previously depended on 'far-jade-porcupine' for any unauthorized changes to package.json or published artifacts.
  • Enforce the use of package lockfiles (e.g., package-lock.json) to pin dependency versions.
  • Implement strict dependency vetting processes, including reviewing package origins and maintainer reputation.
  • Consider rebuilding affected applications from a clean state with verified dependencies.

Frontier verdict — High

Prioritize immediate removal of 'far-jade-porcupine' due to its critical severity and potential for registry pollution and build integrity compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.