MalwarePublished 28 Jul 2026Updated 27 Aug 2026

parallely (npm) · Malicious Code

Affects parallelySource GCVE Database

Malicious package : remove parallely and rotate any secrets on hosts that installed it.

Data as of 12 Sep 2026, 07:16 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-11143

What to do

Remove parallely from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmparallely	Affected =10.0.3 =10.0.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'parallely' is a malicious typosquatting package impersonating 'concurrently'. It contains code that decrypts and downloads a platform-specific payload at runtime, installs anti-analysis measures, and executes the payload with persistence mechanisms. This compromises any system where the package is installed, potentially giving attackers full control. Immediate removal and secret/key rotation are advised.

Impact

Any computer with the 'parallely' package installed or running is considered fully compromised. Attackers may gain full control over the system, potentially accessing all stored secrets and keys. Removal of the package alone may not eliminate all malicious components, as the payload establishes persistence and anti-analysis defenses.

Defensive guidance

The package should be immediately removed from all affected systems. All secrets and keys stored on compromised machines must be rotated from a different, trusted computer. Due to the advanced persistence and anti-analysis techniques, a full system compromise should be assumed, and thorough incident response procedures should be followed.

Summary

The 'parallely' npm package impersonates the legitimate 'concurrently' package by advertising its repository, author, and funding in package.json while delivering different malicious code. Upon loading, an IIFE decrypts a hidden download URL using AES-256-GCM with a key derived from XORing four base64 constants and hardcoded IV and authentication tag. It then downloads a platform-specific payload (Linux/macOS binary or Windows JS) into a temporary directory, verifies its SHA-256 hash against a fetched metadata file, sets executable permissions, removes macOS quarantine attributes, and spawns the payload detached. The code includes anti-analysis features that disable uncaught exception and warning handlers, check for debugging via /proc/self/status, inspector URLs, and command-line flags, aborting if debugging is detected. A self-relaunch mechanism ensures persistence whether the package is imported or executed directly. The command and control host is reconstructed only at runtime to evade static detection. This behavior effectively compromises any host running the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Sep 2026, 07:16 UTC

Technical details

References

Community reviews