Large replaced index.js inside npm package

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•1•0•3

This rule finds an npm package whose main index.js file was swapped for a much larger obfuscated version. Maintainers may not notice a silent replace during a compromise. Compare package hashes to known good releases. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.