Zombie Package

Why dormancy followed by activity is suspicious

Legitimate maintainers tend to follow predictable patterns — regular releases, changelogs, GitHub activity. When a package goes completely silent for over a year and then suddenly releases a new version, one of a few things is happening: the maintainer came back, the project was abandoned and then revived, or someone else now has access to the account.

Attackers specifically target dormant packages because they have established trust — hundreds of thousands of weekly downloads, no recent scrutiny, maintainers who may not even be monitoring the account anymore. It's a much easier target than a recently-updated popular package with active maintainers watching for unusual activity.

The event-stream attack — the original zombie

In 2018, the npm package event-stream had over 2 million weekly downloads. The original maintainer handed it off to a stranger who seemed trustworthy. The new maintainer added a dependency called flatmap-stream containing malicious code targeting a specific Bitcoin wallet. The attack ran undetected for 2.5 months before a developer noticed.

This pattern has repeated dozens of times since. The attacker doesn't even need to hack anything — they just ask to take over an abandoned package and the original maintainer says yes.

How PackageFix detects zombie packages

PackageFix fetches the npm registry's publish history for each package. If a package was dormant for more than 24 months and published a new version within the last 72 hours with more than 100,000 weekly downloads, it gets flagged with a 🧟 ZOMBIE badge: "Updated 4 hours ago after 18 months of inactivity — may indicate compromised maintainer account."