DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 20 Aug 2026Updated 21 Aug 202660 packages · 61 versions

GitHub Advisory malware sweep - 2026-08-20 batch (PyPI `libasync` cryptominer typosquat continuation of `2026-07-pyqt6darktheme` register, PyPI `rc4-secure` OpenSSF PoC, npm `express-route-engine` jsonbin.io eval-loader, `base99-85x` base-x typosquat with plaintext key exfil to `168.231.81.80`, `mc-provider` Cosmos-registry impersonator with `supersig` transitive dropper, `x6842179305` XOR-Function dropper, `ai-texts-utils`+`ai-texts` bundled obfuscator payload, dep-confusion PoC families `dolyame-*`+`fb-*`+`devplatform-*`+`digital-interview-*`+`pfp-*`+`bigops-*`, express+eslint+create-react-app typosquat cluster, blockchain-toolkit typosquats `ethereum-validator`+`polygon-toolkit-validate`)

Summary

31 GHSA CWE-506 advisories in the 24h ending 2026-08-20 06:00 UTC. Headliners: PyPI libasync cryptominer with Windows-registry persistence (campaign 2026-08-libasync, continuation of 2026-07-pyqt6darktheme), npm express-route-engine eval-loader that fetches JSON payloads from jsonbin.io, and base99-85x base-x typosquat that streams caller-supplied private-key/seed material in cleartext to 168.231.81.80.

typosquatdependency-confusioncrypto-wallet-draincredential-theftobfuscationinfostealer
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193
Also known as
2026-08-20 GHSA sweep · libasync pypi cryptominer · base99-85x base-x typosquat · express-route-engine jsonbin.io eval-loader · mc-provider cosmos impersonator
Ecosystems
npmPyPI
Packages tracked
60

What happened

The 24-hour window covering 2026-08-20 published 55 new GHSA CWE-506 advisories (52 npm, 3 PyPI) - the initial 2026-08-20 06:00 UTC pass caught 31, and the 2026-08-21 06:00 UTC backfill (this file's lastUpdated) added another 24 dep-confusion, blockchain-toolkit, and create-react-app typosquat advisories published later on 2026-08-20. This is a scattered follow-up to the 2026-08-19 headline sweep (Sui @mysten/* day 6 targeted, Chinese exam-cheat surveillance, jsonspack pino revival). The Sui @mysten/* typosquat register (days 1-6 running 2026-08-11 through 2026-08-19) does NOT extend into 2026-08-20 - no new Sui-adjacent GHSAs published in this window, suggesting the operator paused after the day-6 targeted payload triggered the vendor attention it did.

Three items in this window carry material per-package IOCs (rare across a 31-advisory sweep) and drive the file: libasync (Windows-registry-persistent cryptominer), express-route-engine (jsonbin.io eval-loader), and base99-85x (plaintext key exfil). The rest split evenly between PoC/dep-confusion shapes and boilerplate "assume host compromised" advisories.

Cluster A - PyPI libasync cryptominer (1 package)

| Package | Versions | GHSA | Campaign | Payload | |---|---|---|---|---| | libasync | <= 1.0.0 | GHSA-7vpc-7xx6-5v47 | 2026-08-libasync | Downloads and executes remote binary on import (not just install); Windows registry persistence; sandbox detection; cryptominer; obfuscated payload inside native extension |

Hashes: a46929f4…eb9c, 11d7c6bd…a278, b7e770b7…c0d0.

Campaign identifier ties this to the 2026-07-pyqt6darktheme PyPI cryptominer register disclosed and tracked by OpenSSF (kam193). Same infrastructure shape (Windows-first, native-extension carrier, registry persistence, sandbox-aware), fresh typosquat surface (libasync targets the async / asyncio ecosystem). Expect additional siblings under async-adjacent names in the days ahead.

Cluster B - PyPI rc4-secure OpenSSF PoC (1 package)

| Package | Versions | GHSA | Campaign | Payload | |---|---|---|---|---| | rc4-secure | 1.0.0 | GHSA-q3mh-hmf4-7c8m | 2026-08-rc4-secure | Downloads and executes remote binary; observed sample fetches an unrelated legitimate binary (consistent with OpenSSF PoC / research canary) |

Hash: c00d4194…73bd. The shape is fully weaponisable - a real second-stage URL on a re-publish would compromise every install runner. Treat as if it were a live drop.

Parallel item folded into yesterday's file: reqcrypt-dev@0.1.0 (GHSA-f4gc-vf6c-945w, hash 8e66755912…f3e4) is the same 2026-08-reqcrypt campaign as reqcrypt from 2026-08-19, just re-published under a -dev suffix to survive the reqcrypt takedown. Same HTTP-response exec() backdoor.

Cluster C - npm express-route-engine jsonbin.io eval-loader (1 package)

| Package | Versions | GHSA | Payload | |---|---|---|---| | express-route-engine | <= 3.6.3 | GHSA-xvv6-j32c-qxhp | On import, fetches JSON blob from https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92, extracts cerookie field, Function() eval - full Node.js RCE |

Hash: 8f540413…c55d. Disguised as "normalize-path (ES6 safe version)" with decoy helper functions to defeat casual review. Because jsonbin.io bins are mutable, the operator can rotate second-stage content without republishing the malicious package - once installed, any future require('express-route-engine') (or the module its bundler pulled in) fetches whatever the operator has queued at that bin ID.

api.jsonbin.io is a common malware-C2 host in 2026 sweeps because it presents as legitimate SaaS API infrastructure and is not on typical block lists. Add to your DNS RPZ / perimeter deny for build runners unless a specific service explicitly needs it.

Cluster D - npm base99-85x base-x cleartext key exfil (1 package)

| Package | Versions | GHSA | Payload | |---|---|---|---| | base99-85x | <= 5.0.2 | GHSA-6h69-gw54-v5hv | Typosquat of base-x; overridden decode() POSTs every input as JSON to http://168.231.81.80:3001/api/log in cleartext before returning decoded value |

Hash: 92b7a431…240d. This is the highest-severity item in the window: base-x is a foundational encoding library, and its decode() is what callers use to parse base58/base64-encoded private keys, seed phrases, wallet keystores, and cryptographic secret material. A project that swapped base-x for base99-85x has leaked its callers' key material in cleartext to 168.231.81.80 for the entire duration of the exposure - not encrypted, not obfuscated, plain JSON.

The exfil call is inlined into both the CJS and ESM builds, so no module system dodges it. Every developer, CI runner, or production host that ran code through the fake decode() while the package was live must be treated as key-compromised.

Cluster E - npm mc-provider Cosmos-registry impersonator (1 package)

| Package | Versions | GHSA | Payload | |---|---|---|---| | mc-provider | <= 1.0.10 | GHSA-g2p9-4368-m8g2 | README promises Cosmos chain-registry exports; actual code loads runtime dep supersig and re-exports its HttpProvider - all wallet/dApp RPC traffic silently redirected through attacker infrastructure |

The payload lives in a transitive dep (supersig) named to sound generic, so source-scanning mc-provider alone will miss it. Any Cosmos-chain wallet or dApp that pulled mc-provider and used its HttpProvider sent RPC reads and signed transaction submissions through the operator's server, letting them observe, block, or rewrite in flight.

Cluster F - npm x6842179305 XOR-Function dropper (1 package)

| Package | Versions | GHSA | Payload | |---|---|---|---| | x6842179305 | 1.0.0, 1.0.1 | GHSA-v8r3-5x6v-p289 | Burner numeric name, no README, 1.js XOR-decodes a keyed byte buffer and Function()-evals it on import; ui.js uses same decoder shape |

Hash: ca4cf1d3…5638. Statically-untypable payload, no benign engineering justification for this shape - assume full RCE on any host that installed it.

Cluster G - npm ai-texts-utils + ai-texts bundled obfuscator (2 packages)

| Package | Versions | GHSA | Payload | |---|---|---|---| | ai-texts-utils | 1.0.3 | GHSA-2gmj-4q5j-qpxf, GHSA-3p3q-38q9-rr37 | Bundled dep literally named ai-texts carries obfuscator.io payload: 43-entry rotated string array, custom base64 decoder, Function() global capture, self-defending console wrappers; runs at import time | | ai-texts | >= 0 | GHSA-h6w4-w8pj-2pwx | Same bundled component published as standalone package |

Hash for ai-texts-utils bundled payload: a3403480…922c (Amazon Inspector detection). Because the payload triggers on require(), --ignore-scripts does not block it. The two GHSAs on ai-texts-utils (one malware-classification, one malicious-code) reflect the standard OpenSSF + GitHub-security dual-labeling for the same finding.

Cluster H - npm dep-confusion PoC families (10 packages)

| Package | GHSA | Suspected target | |---|---|---| | dolyame-ui-form | GHSA-x6j7-22fv-cjwc | Dolyame (Russian BNPL fintech) | | dolyame-boxy-independent-bnpl-info-images | GHSA-r7x5-x2pm-qx2v | Dolyame | | dolyame-boxy-atom-bnpl-store-button | GHSA-j5r7-jm3x-rgch | Dolyame | | fb-forms-form-boilerplate-contacts | GHSA-rrc5-66g2-j59f | Facebook-style fb-* form-boilerplate scope | | fb-cards-form-no-resident-information | GHSA-5gv5-4q77-jc7x | Same fb-* scope | | devplatform-s3-client | GHSA-557v-9r2x-4vj7 | Generic devplatform-* internal scope | | devplatform-spa-testing | GHSA-w476-3rpv-vw8r | Same | | digital-interview-digital-interview-core | GHSA-q8v7-w9cp-xx9g | Interview-platform vendor digital-interview-* | | finance-business-company-id-models | GHSA-mgqh-vwhj-8hqw | Generic finance / business-ID enterprise scope | | mc-provider (also Cluster E) | GHSA-g2p9-4368-m8g2 | Cosmos-registry impersonator |

All ten carry the boilerplate CWE-506 "assume host fully compromised" advisory - no per-package IOC published. The shape is dep-confusion PoC: highly-specific internal-scope names that only match if a private org's .npmrc scope precedence misresolved a private package to the public registry. Almost none of these names have any legitimate open-source use case; a public download from any of them is worth investigating as a private-registry misconfiguration.

Cluster I - npm express + eslint typosquat cluster (5 packages)

| Package | GHSA | |---|---| | express-request-engine | GHSA-684q-384r-cr7r | | express-enrouten-async | GHSA-25jv-xr7c-mx67 | | express-mocha-test | GHSA-7jq4-grp7-9wq3 | | eslint-config-consumerweb | GHSA-2pxg-969f-jc3q | | eslint-commit-parser | GHSA-qmq6-r6mp-r586 |

All carry only boilerplate CWE-506; no per-package IOC published. Names sit in the exact express-*-engine / express-*-test / eslint-config-* / eslint-*-parser space a distracted developer would npm i by mistake - low creativity, high traffic-shape.

Cluster J - npm miscellaneous boilerplate + test/PoC (11 packages)

| Package | GHSA | Notes | |---|---|---| | nano-perf | GHSA-4236-g67q-42fc | 2026-08-20 boilerplate | | tn-advertisement | GHSA-j2c8-6hx3-7994 | 2026-08-20 boilerplate | | node-runtime-utils | GHSA-c436-rrhg-m984 | Runtime-utils typosquat surface | | fetchcraft | GHSA-fg76-g9g4-9xpr | fetch-adjacent typosquat | | webpack-cdn-fetcher | GHSA-gjvp-mjhq-rfwc | webpack ecosystem name-shape | | fe-utils-core | GHSA-8xf7-7m4f-fgrv | Frontend-utils typosquat | | filewisee | GHSA-wp6h-28pg-v4j5 | Generic file- typosquat | | griffin-transliterator | GHSA-4hcm-p7x4-q9h9 | Transliterator library name | | emojifancy-print | GHSA-46c9-x7v7-2g5h | Emoji- typosquat | | bunnyhijack-test-0x00 | GHSA-8x5v-wf85-xhj5 | Research canary - should not appear in production | | test-pkg-yarn | GHSA-r653-6655-p467 | Research canary | | test-pkg-x0 | GHSA-45jm-p8g6-hcxf | Research canary | | test-pkg-pnpm | GHSA-7grv-5j2w-4wx3 | Research canary | | evil-pkg | GHSA-p67r-jq7p-6g7v | Research canary |

The last five carry names that read as OpenSSF / researcher canaries - test-pkg-*, evil-pkg, bunnyhijack-test-*. If any appear in a production lockfile it is not because a developer needed them; it is because someone added a research URL or a copy-paste sample as a real dep, and the transitive chain should be audited for whatever context brought them in.

Registry state

All 31 packages yanked from their respective registries (npm, PyPI) during the takedown windows on 2026-08-19 late and 2026-08-20. Private mirrors that cached tarballs before takedown will keep serving them.

Related tracked activity

  • 2026-07-pyqt6darktheme PyPI cryptominer register (Cluster A): now extends with libasync as a new typosquat surface. Same infrastructure, same discovery credit (kam193), same Windows-registry-persistent shape.
  • 2026-08-reqcrypt PyPI HTTP-response backdoor (Cluster B parallel): sibling reqcrypt-dev folded into yesterday's file rather than duplicated here.
  • *Sui `@mysten/` typosquat multi-day register** (days 1-6 running 2026-08-11 through 2026-08-19): does NOT extend into 2026-08-20 - no Sui-adjacent GHSAs in this window.
  • jsonspack pino-typosquat operator (Cluster C of 2026-08-19): no new siblings in this window.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193. No named threat actor.

Affected packages (60)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - PyPI libasync cryptominer (2026-08-20): libasync@<=1.0.0 (GHSA-7vpc-7xx6-5v47, campaign 2026-08-libasync, hashes a46929f4ba4ca97beaf5511f0be0af36c4d1e9deff65bea3821137c2c258eb9c / 11d7c6bd095b62206bc5b49b6749dfc73ea21e9b5b0b268c84ef4cadd1cba278 / b7e770b71209bbc615ae928de01b04aef48295bf6548fd5f6d6cfffce531c0d0). Downloads and executes a remote binary during import (not just install), establishes persistence via Windows registry modification, hides payload inside a native extension, includes sandbox-detection logic, and runs as a cryptomining agent on the host. Discovery credit and campaign identifier tie this to the multi-week 2026-07-pyqt6darktheme PyPI cryptominer register catalogued by OpenSSF (kam193) - same infrastructure, new typosquat surface
  • Cluster B - PyPI rc4-secure OpenSSF PoC (2026-08-19 late): rc4-secure@1.0.0 (GHSA-q3mh-hmf4-7c8m, campaign 2026-08-rc4-secure, hash c00d4194b32151e318678fb20166e9023d74acbed43e4a9d82f7834569cb73bd). Downloads and executes a remote binary on install; observed sample fetches an unrelated legitimate binary, consistent with an OpenSSF PoC / research canary rather than a weaponised drop, but the shape is a fully weaponisable remote-exec dropper and any republish with a real second-stage URL would compromise every installer. The parallel reqcrypt-dev@0.1.0 (GHSA-f4gc-vf6c-945w, campaign 2026-08-reqcrypt, hash 8e66755912c02a4de1ed6f86b092e2a0dcdadbcaef931cbd07c6d2306619f3e4) is folded into yesterday's 2026-08-19 sweep Cluster H as the reqcrypt sibling
  • Cluster C - npm express-route-engine jsonbin.io eval-loader (2026-08-20): express-route-engine@<=3.6.3 (GHSA-xvv6-j32c-qxhp, hash 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d). On import, fetches a JSON blob from https://api.jsonbin.io/v3/b/6a4f5816f5f4af5e29762c92, extracts a field named cerookie, and executes it via indirect Function constructor lookup - full Node.js RCE. The loader is disguised as "normalize-path (ES6 safe version)" with decoy helper functions to defeat casual code review. Because the payload URL is a mutable jsonbin.io bin, the operator can rotate second-stage content without republishing the package
  • Cluster D - npm base99-85x base-x cleartext key exfil (2026-08-19 late): base99-85x@<=5.0.2 (GHSA-6h69-gw54-v5hv, hash 92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d). Typosquat of the widely-used base-x module; the overridden decode() function POSTs every caller-supplied input as JSON to http://168.231.81.80:3001/api/log in cleartext before returning the decoded value. Because base-x callers commonly pass base58/base64-encoded wallet private keys, seed phrases, and cryptographic material, any project that swapped in base99-85x has leaked its callers' key material to the operator. The exfil path is inlined in both CJS and ESM builds so no module system dodges it
  • Cluster E - npm mc-provider Cosmos-registry impersonator (2026-08-19 late): mc-provider@<=1.0.10 (GHSA-g2p9-4368-m8g2). README falsely promises Cosmos chain-registry exports (assets, chains, ibc); actual code dynamically loads a runtime dependency named supersig and re-exports its HttpProvider. Wallet and dApp code that thought it was talking to a Cosmos RPC provider is silently redirected through an attacker-controlled HTTP/RPC provider - every signed transaction and RPC read is now visible to and rewritable by the operator. The malicious payload lives in the supersig transitive dep, so scanning mc-provider source alone misses it
  • Cluster F - npm x6842179305 XOR-Function dropper (2026-08-19 late): x6842179305@1.0.0,1.0.1 (GHSA-v8r3-5x6v-p289, hash ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638). Burner-style numeric package name, no README, no legitimate API surface; entry file 1.js XOR-decodes a keyed byte buffer and passes the result to the Function constructor, executing arbitrary code on module import. Companion file ui.js uses the same decoder shape. The static-untypable payload cannot be safely analysed without dynamic instrumentation - treat every install as full RCE
  • Cluster G - npm ai-texts-utils+ai-texts bundled obfuscator payload (2026-08-19 late): ai-texts-utils@1.0.3 (GHSA-2gmj-4q5j-qpxf, hash a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c; parallel malware-classification GHSA-3p3q-38q9-rr37) and ai-texts@>=0 (GHSA-h6w4-w8pj-2pwx). ai-texts-utils ships a bundled dependency literally named ai-texts containing obfuscator.io-grade code: 43-entry rotated string array, custom base64 decoder, Function() global capture, self-defending/debug-protection wrappers around console. Executes at import time on any host that pulls ai-texts-utils - the standalone ai-texts GHSA covers the bundled component published under its own name too
  • Cluster H - npm dep-confusion PoC families (20 packages, 2026-08-19 late through 2026-08-20): A batch of same-day GHSA-classified npm packages whose names read as internal-scope dep-confusion bait against specific orgs, each shipping the boilerplate CWE-506 "full compromise" advisory: Dolyame (Russian BNPL fintech) - dolyame-ui-form, dolyame-boxy-independent-bnpl-info-images, dolyame-boxy-atom-bnpl-store-button, dolyame-boxy-desktop-bnpl-card-panel; *Facebook-style `fb- form-boilerplate** - fb-forms-form-boilerplate-contacts, fb-cards-form-no-resident-information; **generic devplatform-` - devplatform-s3-client, devplatform-spa-testing, devplatform-api-clients, platform-ui-codemods; generic `digital-interview-** - digital-interview-digital-interview-core; **generic finance-* / hr-* recon** - finance-business-company-id-models, goldstar-api-server; **pfp- / pfa- financial-forms scope** - pfp-forms-sme-sitebuilder, pfp-forms-sme-loan, pfp-forms-insurance-health, pfp-forms-independent-sme-glossary-anchor, pfp-block-mobile-steps, pfa-errors; **bigops-` DevOps-tooling scope* - bigops-watchdog-angular, bigops-umf-statist. Advisories lack per-package IOCs but the highly-specific internal-name shape is the fingerprint - assume any org whose private .npmrc scope precedence resolved one of these to the public registry has been recon'd
  • Cluster I - npm express + eslint + create-react-app + blockchain-toolkit typosquat cluster (14 packages, 2026-08-19 late through 2026-08-20): express-request-engine@>=0 (GHSA-684q-384r-cr7r), express-enrouten-async@>=0 (GHSA-25jv-xr7c-mx67), express-mocha-test@>=0 (GHSA-7jq4-grp7-9wq3), eslint-config-consumerweb@>=0 (GHSA-2pxg-969f-jc3q), eslint-commit-parser@>=0 (GHSA-qmq6-r6mp-r586), create-react-app-text@>=0 (GHSA-9324-2pfx-4w9r), create-react-app-ux@>=0 (GHSA-rxpg-3mx3-fwqm), create-react-app-ui@>=0 (GHSA-qvrq-vg6m-5cr8), sigchain-js@>=0 (GHSA-xq2c-h4ch-xmwj), exam-kit@>=0 (GHSA-3g8c-37c3-75vv), @pablo_clueless/sniffr@>=0 (GHSA-2gvc-mrh5-885x), @pablo_clueless/printr@>=0 (GHSA-3jxq-xch2-6hpm), ethereum-validator@>=0 (GHSA-f4c6-m557-c5qf), polygon-toolkit-validate@>=0 (GHSA-w4vh-7827-g474). All ship the boilerplate CWE-506 "assume host fully compromised" advisory with no per-package IOC published. Naming targets the express/eslint/create-react-app ecosystems, plus blockchain-toolkit typosquat surface (ethereum-validator, polygon-toolkit-validate) that a Web3 developer would casually npm i when reaching for a signer or validator utility
  • Cluster J - npm miscellaneous boilerplate malware (13 packages, 2026-08-19 late through 2026-08-20): nano-perf@>=0 (GHSA-4236-g67q-42fc, 2026-08-20), tn-advertisement@>=0 (GHSA-j2c8-6hx3-7994, 2026-08-20), node-runtime-utils@>=0 (GHSA-c436-rrhg-m984), fetchcraft@>=0 (GHSA-fg76-g9g4-9xpr), webpack-cdn-fetcher@>=0 (GHSA-gjvp-mjhq-rfwc), fe-utils-core@>=0 (GHSA-8xf7-7m4f-fgrv), filewisee@>=0 (GHSA-wp6h-28pg-v4j5), griffin-transliterator@>=0 (GHSA-4hcm-p7x4-q9h9), emojifancy-print@>=0 (GHSA-46c9-x7v7-2g5h), optimize-regex@>=0 (GHSA-vrj5-6f7q-fx9g), rallycoding@>=0 (GHSA-xh99-h4gh-gcv6), o3forms@>=0 (GHSA-gp6v-h28c-4fxf), plus test/researcher-shape bunnyhijack-test-0x00@>=0 (GHSA-8x5v-wf85-xhj5), test-pkg-yarn@>=0 (GHSA-r653-6655-p467), test-pkg-x0@>=0 (GHSA-45jm-p8g6-hcxf), test-pkg-pnpm@>=0 (GHSA-7grv-5j2w-4wx3), evil-pkg@>=0 (GHSA-p67r-jq7p-6g7v). All are CWE-506-classified with the "assume host fully compromised" boilerplate. The test-pkg-* / evil-pkg / bunnyhijack-test-* names are OpenSSF / researcher canaries - they should NEVER appear in a production lockfile; if they do, someone added a research URL as a real dep

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for the 31 package names below
  2. 2For Cluster A matches (libasync PyPI cryptominer): uninstall from every virtualenv and reimage Windows hosts - the malware sets registry persistence and runs a cryptomining agent, so removing the pip package alone does not stop the mining. Audit Task Scheduler, Startup folder, HKCU\Software\Microsoft\Windows\CurrentVersion\Run, and HKLM\...\Run for anomalous entries. Check for high sustained CPU on hosts that installed libasync between the publish date and takedown. Cross-reference the 2026-07 pyqt6darktheme cryptominer register - if your ML/scientific-Python environments matched libasync, they may also match the earlier campaign names
  3. 3For Cluster B matches (rc4-secure): uninstall. The observed sample looks PoC-shaped, but assume a weaponised republish already ran on any host that installed it before takedown; rotate credentials the host could reach as a precaution
  4. 4For Cluster C matches (express-route-engine): uninstall and rotate every credential the Node.js process could touch - the Function() loader gets full Node capability. Block outbound to api.jsonbin.io at the perimeter from every build runner unless a specific service explicitly needs it - jsonbin.io is a common malware-C2 host because it looks legitimate and is rarely denylisted
  5. 5For Cluster D matches (base99-85x base-x typosquat): uninstall and correct to the real base-x package. Treat every private key, seed phrase, wallet keystore, and cryptographic secret the application handled while base99-85x was in the dep tree as leaked - the operator has plaintext copies at 168.231.81.80. Rotate wallet keys, generate fresh seed phrases, migrate funds to fresh addresses. Block egress to 168.231.81.80 at the perimeter and via DNS RPZ so that any lingering install can no longer exfil
  6. 6For Cluster E matches (mc-provider Cosmos impersonator): uninstall and correct to the actual @cosmos-kit/* / chain-registry package the project meant to use. Audit every signed Cosmos-chain transaction the affected app produced during the exposure window - the operator's HttpProvider could rewrite RPC responses used to derive tx bodies. Also remove the transitive supersig package if pinned
  7. 7For Cluster F matches (x6842179305): uninstall, treat host as fully compromised, rotate all credentials, reimage build runners on any hit. A numeric-burner package name that XOR-decodes a Function-constructor payload has no benign use case
  8. 8For Cluster G matches (ai-texts-utils / ai-texts): uninstall from every project. Because the payload runs at import (not postinstall), --ignore-scripts does NOT block it - the first require('ai-texts-utils') runs the obfuscator payload. Rotate cloud credentials on any host that ever imported either package; correct to whichever legitimate text-normalisation library the developer meant
  9. 9For Cluster H matches (dep-confusion PoC families): uninstall each. If your .npmrc scope precedence caused a private dolyame-* / fb-* / devplatform-* / digital-interview-* / finance-* package to resolve to the public registry, fix the precedence (registry= for the private mirror, always-auth=true, and scoped @scope:registry= for public scopes only) and audit the manifest for other private-scope names that could get hijacked. Treat any install as full RCE until proven otherwise
  10. 10For Cluster I matches (express/eslint typosquat): uninstall each. Even though these carry only the boilerplate CWE-506 advisory (no per-package IOC published), the operator surface (express-*-engine, eslint-config-*) is the exact space a distracted developer would npm i by mistake; correct to the real dependency and treat any install as full RCE
  11. 11For Cluster J matches (miscellaneous boilerplate + test/PoC): uninstall each. If a test-pkg-*, evil-pkg, or bunnyhijack-test-* appears in a production lockfile, treat as an unauthorised research-canary insertion and rotate credentials on the host - a real dependency should never carry that name
  12. 12For all npm installs in CI, run with --ignore-scripts as defence-in-depth - but note it does NOT stop Clusters C, D, E, G, or F (they trigger on import/require, not postinstall). For all pip install runs, prefer --only-binary=:all: where feasible to skip setup.py execution
  13. 13Verify none of the 31 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-20-ghsa-malware-sweep