# GHSA-flagged malware brands - 16 autotel-*, 4 awaitly-*, and `ai-sdk-ollama` packages (Nov 2025–Jun 2026) marked embedded-malicious-code on 2026-06-29/30

> GitHub's Advisory Database dropped CWE-506 (Embedded Malicious Code) records on 2026-06-29 and 2026-06-30 against 21 npm "brand" packages built up over months: the entire `autotel-*` observability family (16 packages, 400+ versions), the `awaitly` promise-utility family (4 packages, ~180 versions), and the `ai-sdk-ollama` Vercel AI-SDK typosquat (55 versions). Every published version of every listed package is now classified as malware.

- Published: 2026-06-30
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: npm
- Scope: 21 packages, 939 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft
- Also known as: autotel malware brand, awaitly malware brand
- Detected by: GitHub Advisory Database
- Incident ID: npm-2026-06-30-autotel-awaitly-brand-takedown

## Affected packages (21)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [ai-sdk-ollama](https://dependencywatch.io/package/npm/ai-sdk-ollama) | npm | 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.8.0, 0.8.1, 0.9.0, 0.10.0, 0.10.1, 0.11.0, 0.12.0, 0.13.0, 0.13.1, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 2.1.0, 2.2.0, 2.2.1, 3.0.0, 3.0.1, 3.1.0, 3.1.1, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.7.1, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 4.0.0, 4.0.0-beta.0 |
| [autotel-backends](https://dependencywatch.io/package/npm/autotel-backends) | npm | 2.0.1, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.7.0, 2.7.1, 2.7.2, 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.9.0, 2.9.1, 2.10.0, 2.11.0, 2.11.1, 2.11.2, 2.11.3, 2.11.4, 2.12.0, 2.12.1, 2.12.2, 2.12.3, 2.12.4, 2.12.5, 2.12.6, 2.12.7, 2.12.8, 2.12.9, 2.12.10, 2.12.13, 2.12.14, 2.12.15, 2.12.16, 2.12.17, 2.12.18, 2.12.19, 2.12.20, 2.12.21, 2.12.22, 2.12.23, 2.12.24, 2.12.25, 2.12.26, 2.12.27, 2.12.28, 2.12.29, 2.12.30, 2.12.31, 2.12.32, 2.12.33, 2.12.34, 2.12.35, 2.12.36 |
| [autotel-cli](https://dependencywatch.io/package/npm/autotel-cli) | npm | 0.1.0, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 0.8.11, 0.8.12, 0.8.13, 0.8.14, 0.8.15, 0.9.0, 0.9.1, 0.10.0, 0.11.0 |
| [autotel-drizzle](https://dependencywatch.io/package/npm/autotel-drizzle) | npm | 0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.0.10, 0.0.11, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.18, 0.0.19, 0.0.20, 0.0.21, 0.0.22, 0.0.23, 0.0.24, 0.0.25, 0.0.26, 0.0.27, 0.0.28, 0.0.29, 0.0.30, 0.0.31, 0.0.32, 0.0.33, 0.0.34, 0.0.35, 0.0.36, 0.0.37 |
| [autotel-eventcatalog](https://dependencywatch.io/package/npm/autotel-eventcatalog) | npm | 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 4.0.2, 5.0.0, 5.0.1, 5.0.2, 6.0.0, 7.0.0, 8.0.0, 9.0.0, 10.0.0, 11.0.0 |
| [autotel-hono](https://dependencywatch.io/package/npm/autotel-hono) | npm | 0.1.0, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.13, 0.4.14, 0.4.15, 0.4.16, 0.4.17, 0.4.18, 0.4.19, 0.4.20, 0.4.21, 0.4.22, 0.4.23, 0.4.24, 0.4.25, 0.4.26, 0.4.27, 0.4.28, 0.4.29, 0.4.30, 0.4.31, 0.4.32, 0.4.33, 0.4.34, 0.4.35, 0.4.36 |
| [autotel-mcp](https://dependencywatch.io/package/npm/autotel-mcp) | npm | 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.1.15, 0.1.16, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 9.0.0, 9.0.1, 10.0.0, 10.0.1, 11.0.0, 11.0.1, 13.0.0, 13.0.1, 14.0.0, 14.0.1, 15.0.0, 15.0.1, 15.0.2, 16.0.0, 16.0.1, 17.0.0, 17.0.1, 17.0.2, 18.0.0, 18.0.1, 19.0.0, 19.0.1, 20.0.0, 20.0.1, 21.0.0, 21.1.0, 21.1.1, 22.0.0, 22.0.1, 23.0.0, 23.0.1, 24.0.0, 24.0.1, 25.0.0, 25.0.1, 26.0.0, 26.0.1, 26.0.2, 27.0.0, 27.0.1, 28.0.0, 28.0.1, 28.0.2, 28.0.3, 29.0.0, 29.0.1 |
| [autotel-mcp-instrumentation](https://dependencywatch.io/package/npm/autotel-mcp-instrumentation) | npm | 29.0.0, 29.0.1, 29.0.2, 30.0.0, 30.0.3, 30.0.4, 30.0.5, 31.0.0, 31.0.1, 32.0.0, 32.0.1, 33.0.0, 33.0.1, 33.0.2, 34.0.0, 34.0.1, 34.0.2, 35.0.0, 36.0.0, 37.0.0, 38.0.0, 39.0.0, 40.0.0 |
| [autotel-mongoose](https://dependencywatch.io/package/npm/autotel-mongoose) | npm | 0.0.1, 0.0.2, 0.0.3, 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.0.3, 2.0.4, 2.0.5, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2, 6.0.0, 6.0.1, 6.0.2, 7.0.0, 8.0.0, 8.1.0, 9.0.0, 10.0.0, 10.1.0, 10.1.1, 11.0.0, 12.0.0 |
| [autotel-pact](https://dependencywatch.io/package/npm/autotel-pact) | npm | 0.2.0, 0.2.1, 0.2.2, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 2.0.0, 3.0.0, 4.0.0, 5.0.0, 6.0.0, 7.0.0, 7.0.1, 7.0.2 |
| [autotel-playwright](https://dependencywatch.io/package/npm/autotel-playwright) | npm | 0.1.0, 0.2.0, 0.2.1, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12, 0.4.13, 0.4.14, 0.4.15, 0.4.16, 0.4.19, 0.4.20, 0.4.21, 0.4.22, 0.4.23, 0.4.24, 0.4.25, 0.4.26, 0.4.27, 0.4.28, 0.4.29, 0.4.30, 0.4.31, 0.4.32, 0.4.33, 0.4.34, 0.4.35, 0.4.36, 0.4.37, 0.4.38, 0.4.39, 0.4.40, 0.4.41, 0.4.42 |
| [autotel-plugins](https://dependencywatch.io/package/npm/autotel-plugins) | npm | 0.4.0, 0.5.0, 0.6.0, 0.6.1, 0.6.2, 0.6.3, 0.6.4, 0.6.5, 0.6.6, 0.7.0, 0.7.1, 0.8.0, 0.8.1, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.13.0, 0.14.0, 0.14.1, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.18.0, 0.18.1, 0.18.2, 0.18.3, 0.19.0, 0.19.1, 0.19.2, 0.19.3, 0.19.4, 0.19.5, 0.19.6, 0.19.7, 0.19.8, 0.19.9, 0.19.10, 0.19.13, 0.19.14, 0.19.15, 0.19.16, 0.19.17, 0.19.18, 0.19.19, 0.19.20, 0.19.21, 0.19.22, 0.19.23, 0.19.24, 0.19.25, 0.19.26, 0.19.27, 0.19.28, 0.19.29, 0.19.30, 0.19.31, 0.19.32, 0.19.33, 0.19.34, 0.19.35, 0.19.36 |
| [autotel-sentry](https://dependencywatch.io/package/npm/autotel-sentry) | npm | 0.1.0, 0.1.1, 0.1.2, 0.2.0, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.5.0, 0.5.1, 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7, 0.5.8, 0.5.10, 0.5.11, 0.5.12, 0.5.13, 0.5.14, 0.5.15, 0.5.16, 0.5.17 |
| [autotel-subscribers](https://dependencywatch.io/package/npm/autotel-subscribers) | npm | 4.0.0, 4.1.0, 4.1.1, 5.0.0, 5.0.1, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 9.0.0, 9.0.1, 10.0.0, 10.0.1, 11.0.0, 11.0.1, 12.0.0, 12.0.1, 13.0.0, 13.0.1, 14.0.0, 14.1.0, 14.1.1, 15.0.0, 15.0.1, 16.0.0, 16.0.1, 16.0.2, 17.0.0, 17.0.1, 18.0.0, 18.0.1, 18.0.2, 18.0.3, 19.0.0, 19.0.1, 20.0.0, 20.0.1, 21.0.0, 21.0.1, 22.0.0, 22.0.1, 22.0.2, 23.0.0, 23.0.1, 23.0.2, 24.0.0, 24.0.1, 25.0.0, 25.0.1, 26.0.0, 26.0.1, 27.0.0, 27.0.1, 27.0.2, 28.0.0, 28.0.1, 28.0.2, 29.0.0, 29.0.1, 29.0.2, 29.0.3, 29.0.4, 29.0.5, 29.0.6, 30.0.0, 30.0.1, 30.0.2, 30.0.3, 30.0.4, 31.0.0, 31.0.3, 31.0.4, 31.1.0, 31.1.1, 31.1.2, 31.1.3, 31.1.4, 32.0.0, 32.0.1, 32.1.0, 33.0.0, 34.0.0, 34.1.0, 34.1.1, 35.0.0, 35.0.1, 35.0.2, 36.0.0, 37.0.0, 38.0.0, 39.0.0, 40.0.0, 41.0.0, 41.0.1, 41.0.2 |
| [autotel-tanstack](https://dependencywatch.io/package/npm/autotel-tanstack) | npm | 1.1.0, 1.2.0, 1.2.1, 1.4.0, 1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.7.1, 1.7.2, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.9.0, 1.9.1, 1.10.0, 1.11.0, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.13.0, 1.13.1, 1.13.2, 1.13.3, 1.13.4, 1.13.5, 1.13.6, 1.13.7, 1.13.8, 1.13.9, 1.13.10, 1.13.11, 1.13.14, 1.13.15, 1.13.16, 1.13.17, 1.13.18, 1.13.19, 1.13.20, 1.13.21, 1.13.22, 1.13.23, 1.13.24, 1.13.25, 1.13.26, 1.13.27, 1.13.28, 1.13.29, 1.13.30, 1.13.31, 1.13.32, 1.13.33, 1.13.34, 1.13.35, 1.13.36, 1.13.37, 1.13.38 |
| [autotel-vitest](https://dependencywatch.io/package/npm/autotel-vitest) | npm | 0.1.0, 0.2.0, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.13, 0.4.14, 0.4.15, 0.4.16, 0.4.17, 0.4.18, 0.4.19, 0.4.20, 0.4.21, 0.4.22, 0.4.23, 0.4.24, 0.4.25, 0.4.26, 0.4.27, 0.4.28, 0.4.29, 0.4.30, 0.4.31, 0.4.32, 0.4.33, 0.4.34, 0.4.35, 0.4.36 |
| [autotel-web](https://dependencywatch.io/package/npm/autotel-web) | npm | 1.1.0, 1.2.0, 1.4.0, 1.4.1, 1.5.0, 1.6.0, 1.6.1, 1.7.0, 1.7.1, 1.8.0, 1.9.0, 1.10.0, 1.10.1, 1.11.0, 1.11.1, 1.11.2, 1.11.5, 1.11.6, 1.12.0, 1.12.1, 1.12.2, 1.12.3, 1.12.4, 1.12.5 |
| [awaitly](https://dependencywatch.io/package/npm/awaitly) | npm | 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.6.0, 1.7.0, 1.8.0, 1.9.0, 1.10.0, 1.11.0, 1.12.0, 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.22.0, 1.23.0, 1.24.0, 1.25.0, 1.26.0, 1.27.0, 1.28.0, 1.29.0, 1.30.0, 1.31.0, 1.31.1, 1.32.0, 1.32.1, 1.33.0, 1.33.1, 1.33.2, 1.33.3, 1.33.4, 1.34.0 |
| [awaitly-analyze](https://dependencywatch.io/package/npm/awaitly-analyze) | npm | 0.10.1, 0.11.0, 0.12.0, 0.12.1, 0.12.2, 0.13.0, 0.14.0, 0.14.1, 0.15.0, 0.16.0, 0.17.0, 0.18.0, 0.19.0, 0.20.0, 0.21.0, 0.22.0, 0.22.1, 0.23.0, 0.23.1, 0.23.2, 0.23.4, 0.24.0, 0.24.1, 0.24.2, 0.24.3, 0.25.0, 0.25.1, 1.0.0, 1.1.0, 1.1.1, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1 |
| [awaitly-libsql](https://dependencywatch.io/package/npm/awaitly-libsql) | npm | 0.1.0, 0.1.1, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 9.0.0, 9.0.1, 10.0.0, 10.0.1, 11.0.0, 11.0.1, 12.0.0, 12.0.1, 13.0.0, 13.0.1, 14.0.0, 14.0.1, 15.0.0, 15.0.1, 16.0.0, 16.0.1, 17.0.0, 17.0.1, 18.0.0, 18.1.0, 18.1.1, 19.0.0, 19.0.1, 20.0.0, 20.0.1, 21.0.0, 21.0.1, 22.0.0, 22.0.1, 22.0.2, 23.0.0 |
| [awaitly-mongo](https://dependencywatch.io/package/npm/awaitly-mongo) | npm | 0.1.0, 0.1.1, 1.0.0, 1.0.1, 2.0.0, 2.0.1, 3.0.0, 3.0.1, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 6.0.0, 6.0.1, 7.0.0, 7.0.1, 8.0.0, 8.0.1, 9.0.0, 9.1.0, 9.1.1, 10.0.0, 10.0.1, 11.0.0, 11.0.1, 12.0.0, 12.0.1, 13.0.0, 13.0.1, 14.0.0, 14.0.1, 15.0.0, 15.0.1, 16.0.0, 16.0.1, 17.0.0, 17.0.1, 18.0.0, 18.0.1, 19.0.0, 19.1.0, 19.1.1, 20.0.0, 20.0.1, 21.0.0, 21.0.1, 22.0.0, 22.0.1, 23.0.0, 23.0.1, 23.0.2, 24.0.0 |

## What happened

On 2026-06-29 and 2026-06-30 GitHub's Advisory Database dropped 21 CWE-506 malware records against npm packages that had been sitting on the public registry as maintained "brand" packages for anywhere from 4 to 7 months. Every listed advisory covers every published version of the named package - the whole brand is flagged, not a single compromised release.

## `autotel-*` - a fake OpenTelemetry auto-instrumentation family

The `autotel` brand launched on npm on 2025-11-26 with `autotel-web`, `autotel-plugins`, `autotel-mcp`, `autotel-subscribers`, and `autotel-backends`, and grew to 16 packages by June 2026: `autotel-cli`, `autotel-hono`, `autotel-sentry`, `autotel-vitest`, `autotel-playwright`, `autotel-tanstack` (Dec 2025 – Feb 2026), then `autotel-mongoose`, `autotel-drizzle`, `autotel-mcp-instrumentation`, `autotel-eventcatalog`, and `autotel-pact` (March–May 2026). Each package presents itself as OpenTelemetry auto-instrumentation for a specific runtime or framework - a plausible cover story that lines up with the real `@opentelemetry/auto-instrumentations-*` and `@opentelemetry/instrumentation-*` scoped packages.

Version cadence is uncharacteristic of a solo weekend project: `autotel-subscribers` reached `v41.0.2` (97 releases), `autotel-mcp` reached `v29.0.1` (74 releases), `autotel-plugins` reached `v0.19.36` (67 releases). Fast SemVer churn on unrelated packages under one brand is a common pattern for building download-count credibility before a payload gets flipped.

## `awaitly-*` - promise + database utility brand

The `awaitly` brand launched 2026-01-16 with `awaitly@1.0.0`, then expanded to `awaitly-analyze` (2026-01-22), `awaitly-mongo` (2026-01-27), and `awaitly-libsql` (2026-01-28). The main `awaitly` reached `v1.34.0` across 42 releases; each database variant reached `v22+` / `v23+` majors across 44–52 releases. The absurdly high majors are the same dep-confusion-resolution tactic used by the 2026-06-29 internal-scope `99.9.1` batch (`@deel-ui/animation`, `@webda-infra-ui/static-images`), scaled down: any internal build looking up an unpinned `awaitly-mongo` name would resolve to the malware brand's `v24.0.0` over a plausible `v1.x` / `v2.x` internal release.

## `ai-sdk-ollama` - Vercel AI SDK Ollama provider typosquat

`ai-sdk-ollama` (55 versions since 2025-08-06) squats on the naming space of Vercel's `ai` SDK provider packages. The legitimate name is `ollama-ai-provider`; the malware flips the noun order to grab autocomplete drift. `v4.0.0-beta.0` and multiple `v3.x` majors give the package a "mature" look for developers browsing releases.

## GHSA attribution and payload

The advisories do not include a payload write-up or attribution. GitHub's standard boilerplate ("rotate all secrets from a different computer") is the only guidance. Given the length of the exposure window and the pattern-match to prior maintainer-takeover and long-tail-typosquat campaigns (`nrwl.angular-console`, `@cap-js/*`, `@tanstack/*`), defenders should assume the payload accessed credential material typical of an npm-lifecycle credential stealer (npm publish tokens, cloud IMDS, HashiCorp Vault, GitHub OIDC).

## Disclosure timeline

- **2025-08-06** - `ai-sdk-ollama` first published.
- **2025-11-26** - `autotel-web`, `autotel-plugins`, `autotel-mcp`, `autotel-subscribers`, `autotel-backends` first published.
- **2025-12-03** - `autotel-tanstack` first published.
- **2026-01-16 – 2026-01-28** - `awaitly`, `awaitly-analyze`, `awaitly-mongo`, `awaitly-libsql` first published.
- **2026-02-11 – 2026-02-14** - `autotel-hono`, `autotel-sentry`, `autotel-vitest`, `autotel-playwright` first published.
- **2026-03-24** - `autotel-mongoose`, `autotel-drizzle` first published.
- **2026-04-15** - `autotel-mcp-instrumentation` first published.
- **2026-05-24 – 2026-05-29** - `autotel-eventcatalog`, `autotel-pact` first published.
- **2026-06-29** - GitHub Advisories drops CWE-506 records for `autotel-cli`, `autotel-backends`.
- **2026-06-30** - Batch expansion covers the remaining `autotel-*` packages, all four `awaitly*` packages, and `ai-sdk-ollama`.

## Impact

- The GHSA text on every advisory in this batch says "any computer that has this package installed or running should be considered fully compromised" - treat any host that ever installed one of these as breached and rotate credentials from a separate clean device
- Unlike a same-day typosquat push, these brands ran for 4–7 months (autotel-* since 2025-11-26, awaitly since 2026-01-16) collecting downloads before the advisory dropped - the exposure window is long and pre-yank installs may already have executed the payload
- `autotel-*` masquerades as OpenTelemetry auto-instrumentation for popular stacks (TanStack, Vitest, Playwright, Sentry, Hono, Drizzle, Mongoose, MCP, Pact, EventCatalog); ops engineers wiring up traces are the natural victim profile
- `awaitly-*` masquerades as promise-timeout / async-flow utilities with database-flavour variants (`-mongo`, `-libsql`); the very high `v22.0.0` / `v23.0.0` majors were used to backstop dep-confusion resolution against any plausible internal SemVer
- `ai-sdk-ollama` typosquats the Vercel `ai` SDK's official Ollama provider, targeting developers who Copilot-autocomplete `import { ollama } from "ai-sdk-ollama"` instead of the real name

## What to do

1. Remove every `autotel-*`, `awaitly*`, and `ai-sdk-ollama` reference from `package.json`, lockfiles, CI image layers, and committed `node_modules`
2. For OpenTelemetry auto-instrumentation, use the official `@opentelemetry/auto-instrumentations-*` scoped packages - never the flat `autotel-*` slugs
3. For async utilities, prefer built-in `Promise.withResolvers()` / `AbortSignal.timeout()` (Node 20+) or well-known packages like `p-timeout`; the `awaitly*` naming space is entirely attacker-controlled
4. For Ollama with the Vercel AI SDK, use the official provider `ollama-ai-provider` (or the framework's built-in provider) - the specific flat name `ai-sdk-ollama` is the malware slot
5. If you ever pinned any version of any listed package: treat the runtime and any artefact it produced as compromised, and audit your CI cache history and internal npm mirror for the specific tarball hashes

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-mhh3-45v6-6vmh - autotel-tanstack malware advisory](https://github.com/advisories/GHSA-mhh3-45v6-6vmh) - GitHub
- [GHSA-7cv4-gfx4-2c3v - autotel-mcp-instrumentation malware advisory](https://github.com/advisories/GHSA-7cv4-gfx4-2c3v) - GitHub
- [GHSA-4vjc-qq25-pvc4 - autotel-mongoose malware advisory](https://github.com/advisories/GHSA-4vjc-qq25-pvc4) - GitHub
- [GHSA-43fx-93g7-w27h - autotel-pact malware advisory](https://github.com/advisories/GHSA-43fx-93g7-w27h) - GitHub
- [GHSA-fgj5-m9vh-ffjw - autotel-plugins malware advisory](https://github.com/advisories/GHSA-fgj5-m9vh-ffjw) - GitHub
- [GHSA-6pcg-qh3x-h5pg - autotel-playwright malware advisory](https://github.com/advisories/GHSA-6pcg-qh3x-h5pg) - GitHub
- [GHSA-rxgj-x3gg-2fg8 - autotel-sentry malware advisory](https://github.com/advisories/GHSA-rxgj-x3gg-2fg8) - GitHub
- [GHSA-37wr-f689-9c3c - autotel-subscribers malware advisory](https://github.com/advisories/GHSA-37wr-f689-9c3c) - GitHub
- [GHSA-hhr2-ppwm-hgqr - autotel-drizzle malware advisory](https://github.com/advisories/GHSA-hhr2-ppwm-hgqr) - GitHub
- [GHSA-c2jx-wr8m-cv28 - autotel-hono malware advisory](https://github.com/advisories/GHSA-c2jx-wr8m-cv28) - GitHub
- [GHSA-h58c-49hq-mq6c - autotel-eventcatalog malware advisory](https://github.com/advisories/GHSA-h58c-49hq-mq6c) - GitHub
- [GHSA-3wmg-66hp-xhv9 - autotel-mcp malware advisory](https://github.com/advisories/GHSA-3wmg-66hp-xhv9) - GitHub
- [GHSA-3729-344x-9v28 - autotel-cli malware advisory](https://github.com/advisories/GHSA-3729-344x-9v28) - GitHub
- [GHSA-9p9m-f2hg-9gxm - autotel-backends malware advisory](https://github.com/advisories/GHSA-9p9m-f2hg-9gxm) - GitHub
- [GHSA-c8c9-7f3h-7c76 - awaitly malware advisory](https://github.com/advisories/GHSA-c8c9-7f3h-7c76) - GitHub
- [GHSA-4vpc-g7mx-4m5v - awaitly-mongo malware advisory](https://github.com/advisories/GHSA-4vpc-g7mx-4m5v) - GitHub
- [GHSA-hv34-4pjp-j28h - awaitly-analyze malware advisory](https://github.com/advisories/GHSA-hv34-4pjp-j28h) - GitHub
- [GHSA-j6m2-hp97-pv4j - awaitly-libsql malware advisory](https://github.com/advisories/GHSA-j6m2-hp97-pv4j) - GitHub
- [GHSA-m9j7-x8ww-5jwr - ai-sdk-ollama malware advisory](https://github.com/advisories/GHSA-m9j7-x8ww-5jwr) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-06-30-autotel-awaitly-brand-takedown
Markdown version: https://dependencywatch.io/incident/npm-2026-06-30-autotel-awaitly-brand-takedown.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).