OpenSSF/OSV advisory MAL-2026-11143 confirms this npm version as malicious. parallely impersonates the `concurrently` package: package.json copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and ships bin entries named `concurrently` and `conc`. dist/lib/spawn.js injects a dropper into `resolveShell()` that fires whenever the library's `concurrently()` API is invoked or its `concurrently`/`conc` bin is run...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in parallely (npm)
Details
parallely impersonates the `concurrently` package: package.json copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and ships bin entries named `concurrently` and `conc`. dist/lib/spawn.js injects a dropper into `resolveShell()` that fires whenever the library's `concurrently()` API is invoked or its `concurrently`/`conc` bin is run. The dropper re-spawns itself detached with an env guard to run once, performs anti-analysis checks (Linux /proc TracerPid, Node --inspect/--debug flags, inspector.url()), reconstructs an AES-256-GCM key by XOR-combining four base64 blobs, decrypts a hidden download URL via createDecipheriv("aes-256-gcm",...).setAuthTag(...), fetches a platform-specific payload, writes it to os.tmpdir()/ins-<euid>/{linux|mac|win.js}, and executes it detached with stdio ignored and windowsHide set. The destination host is not present as a plain string, defeating static extraction.
Decision reason
No blocking static signals were detected.