# GitHub Advisory quiet-tail sweep - 2026-08-16 / 2026-08-17 (`@ai-vertical/ai-agent` npm generic-malware + `kb-ai` PyPI OpenSSF `setup.py`-install pentest dep-confusion demo)

> Two-day quiet-tail after 08-15's 22-package burst: only two new GHSA advisories. `@ai-vertical/ai-agent@1.0.0,1.0.1` (npm, GHSA-3248-8gvm-g9jv) has the generic malware boilerplate and no IOC. `kb-ai@0.1.0,0.1.1` (PyPI, GHSA-34mp-hr4q-qvh5) is an OpenSSF `PROBABLY_PENTEST` demo overriding `setup.py install` to exfil IP + username.

- Published: 2026-08-17
- Severity: medium
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 2 packages, 4 compromised versions
- Tags: dependency-confusion, obfuscation
- Also known as: 2026-08-16 GHSA pip singleton, 2026-08-17 GHSA npm singleton
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages
- Incident ID: multi-2026-08-17-ghsa-quiet-tail

## Affected packages (2)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@ai-vertical/ai-agent](https://dependencywatch.io/package/npm/@ai-vertical/ai-agent) | npm | 1.0.0, 1.0.1 |
| [kb-ai](https://dependencywatch.io/package/pypi/kb-ai) | PyPI | 0.1.0, 0.1.1 |

## What happened

The 24-hour window ending 2026-08-17 06:00 UTC was a quiet-tail after the 08-15 22-package `@velliajs/discord`/`akamai(js)-sensor`/HackerOne-canary burst (see [2026-08-15 sweep](https://dependencywatch.io/incident/npm-2026-08-15-ghsa-malware-sweep)). Only two GHSA CWE-506 advisories were published across npm + PyPI in that window, so both are collected here as a single multi-ecosystem entry rather than as two per-day sweep files.

## `@ai-vertical/ai-agent` (npm)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `@ai-vertical/ai-agent` | `1.0.0`, `1.0.1` | GHSA-3248-8gvm-g9jv | 2026-08-17 | Generic malware boilerplate; no source or per-package IOC published |

The advisory body is the standard GHSA malware notice: "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer." No CVSS, no source repository, no observed C2, no payload description. The scope name suggests naming-canary targeting the AI-agent / LLM-tooling namespace (`@ai-vertical`) — a category we've seen repeatedly in earlier sweeps (`@guangnao/agent-proxy` on 08-14, the `xrblocks-mcp` MCP-scope canary on 08-14, `@openrepl/shared` on 08-15). Treat as full-control install-time execution until an IOC lands.

## `kb-ai` (PyPI)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `kb-ai` | `0.1.0`, `0.1.1` | GHSA-34mp-hr4q-qvh5 | 2026-08-16 | `setup.py install`-command override; exfil of IP + username; classified `PROBABLY_PENTEST` |

OpenSSF malicious-packages classified this as `PROBABLY_PENTEST` under the `GENERIC-standard-pypi-install-pentest` campaign — the recurring pattern where a bug-bounty researcher or a red-team engagement drops a dependency-confusion demonstration on PyPI to prove a namespace is reachable. The technique itself is real: subclass `setuptools.command.install.install` in `setup.py`, override `run()` to fire off an HTTP callback with `socket.gethostname()` + `getpass.getuser()`, then chain to the standard `install.run(self)`. Because the override lives in the source distribution's `setup.py`, `pip install kb-ai` runs it — `pip install --only-binary=:all: kb-ai` does not, because the malicious code lives in the sdist and no wheel is available.

Source hash from the OpenSSF advisory: `edd64785c168e513c50673e9b031048ba592c1460a9a952f9430feb83bf5042d`.

## Registry state

Both packages remain removed from npm and PyPI respectively. Private mirrors that pinned the versions before takedown will still resolve them; see the mirror-audit note in the recommendations.

## Related tracked activity

- **AI-agent scope naming-canary series**: `@ai-vertical/ai-agent` continues the pattern of typosquat / naming-canary attacks against LLM tooling namespaces seen in [08-14 `@guangnao/agent-proxy`](https://dependencywatch.io/incident/npm-2026-08-14-ghsa-malware-sweep) (Claude/Codex credential monetiser) and [08-15 `@velliajs/discord`](https://dependencywatch.io/incident/npm-2026-08-15-ghsa-malware-sweep) (discord.js impersonator with kill-switch).
- **OpenSSF `PROBABLY_PENTEST` PyPI dep-confusion series**: `kb-ai` is another entry in the same operator-class as `@mexc/shared-utils` (08-14) — bug-bounty demonstrations that prove a namespace is reachable without shipping a real payload. Track separately from real supply-chain attacks; the risk is the reused primitive, not the specific demo.

Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`. No named threat actor.

## Impact

- **`@ai-vertical/ai-agent` (npm, 2 versions)**: GHSA-3248-8gvm-g9jv, published 2026-08-17. Advisory carries only the standard "any computer with this package installed should be considered fully compromised" boilerplate - no source available, no per-package IOC. AI-adjacent scope name (`@ai-vertical`) suggests naming-canary targeting the LLM tooling ecosystem. Treat as arbitrary malware capable of full-control install-time execution until an IOC is published
- **`kb-ai` (PyPI, 2 versions)**: GHSA-34mp-hr4q-qvh5, published 2026-08-16. OpenSSF-tagged `PROBABLY_PENTEST` (campaign `GENERIC-standard-pypi-install-pentest`). `setup.py` overrides the `install` command class to run malicious code during `pip install`; the payload exfiltrates basic host telemetry (IP, username) and is labelled as a dependency-confusion demonstration. Impact is limited (no persistence, no credential harvest) but the install-time RCE primitive is real - a reused primitive by a less-restrained operator could ship an actual payload the same way

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for the two package names below
2. **For `@ai-vertical/ai-agent` matches (npm)**: uninstall and treat the install host as compromised until a specific IOC surfaces - the generic-malware boilerplate on the GHSA advisory means the reviewer confirmed harmful behavior but did not publish a payload description. Rotate anything the install host could reach and reimage if the machine is a build runner. Correct to your intended AI-agent tooling package
3. **For `kb-ai` matches (PyPI)**: uninstall from any Python virtualenv, `.venv`, or system site-packages that ever ran `pip install`. The `setup.py` install-command override runs during install, so no ongoing runtime hook to kill - just remove the package. Because the exfil is only host telemetry, no credential rotation is strictly required, but if you are running an internal PyPI mirror that resolved `kb-ai` at pinned `0.1.0`/`0.1.1`, treat it as a dep-confusion training-target hit and audit the mirror's resolution order
4. For all `pip install` and `npm install` runs in CI, respect the standard hardening: `--no-build-isolation` off (the default), `--only-binary=:all:` where possible for pip to skip `setup.py` execution, and `--ignore-scripts` for npm as defence-in-depth. The `setup.py` override in `kb-ai` is NOT mitigated by `--ignore-scripts` (that flag is npm-side); only `pip install --only-binary=:all:` avoids executing the malicious `install` command class
5. Verify neither package still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-3248-8gvm-g9jv - @ai-vertical/ai-agent (generic-malware boilerplate)](https://github.com/advisories/GHSA-3248-8gvm-g9jv) - GitHub
- [GHSA-34mp-hr4q-qvh5 - kb-ai (PyPI OpenSSF PROBABLY_PENTEST setup.py install-command demo)](https://github.com/advisories/GHSA-34mp-hr4q-qvh5) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-17-ghsa-quiet-tail
Markdown version: https://dependencywatch.io/incident/multi-2026-08-17-ghsa-quiet-tail.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).