NPM-EVERYTHING-2024
Summary
In late December 2023 (widely reported early January 2024), npm user PatrickJS (gdi2290) published a troll package named 'everything' that, via roughly 3000 chunked sub-packages, declared a dependency on every public package in the npm registry. Installing it triggered a denial of service through storage exhaustion and broken build pipelines. Because a package depended on by others cannot be unpublished, this registry-wide dependency web temporarily blocked many maintainers from removing their own packages until GitHub/npm intervened.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-73556
vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m
- MEDIUMCVE-2026-71486
vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
- HIGHCVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines before syntax rejection
- HIGHCVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling
- HIGHCVE-2026-82397
Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
- MEDIUMCVE-2026-81723
NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`