# GitHub Advisory malware sweep - 20+ npm packages (chai-as-*, brock-*, rebrandly-*, dep-confusion + typosquat batch) taken down 2026-06-30

> On 2026-06-30 GitHub's Advisory Database dropped a coordinated batch of ~25 CWE-506 *Embedded Malicious Code* advisories against unrelated npm packages published between 2026-05-27 and 2026-06-30. The batch mixes at least four distinct sub-clusters: `chai-as-persisted` / `chai-as-assured` (Chai typosquats), `brock-loader` / `brock-react-alerts` (with a `9999.0.0` dep-confusion tag), the `rebrandly-domains-*` pair (both `9999.0.0`), and a wider fan-out of standalone malicious names.

- Published: 2026-06-30
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 18 packages, 43 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft
- Also known as: 2026-06-30 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-06-30-ghsa-malware-sweep

## Affected packages (18)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [agent-starter-pack](https://dependencywatch.io/package/npm/agent-starter-pack) | npm | 0.0.1 |
| [brock-loader](https://dependencywatch.io/package/npm/brock-loader) | npm | 1.9.9 |
| [brock-react-alerts](https://dependencywatch.io/package/npm/brock-react-alerts) | npm | 1.99.99, 9999.0.0 |
| [chai-as-assured](https://dependencywatch.io/package/npm/chai-as-assured) | npm | 6.0.4, 7.1.2 |
| [chai-as-persisted](https://dependencywatch.io/package/npm/chai-as-persisted) | npm | 4.2.8, 6.1.9 |
| [confluent-kafka-javascript](https://dependencywatch.io/package/npm/confluent-kafka-javascript) | npm | 0.0.1 |
| [endpointmap](https://dependencywatch.io/package/npm/endpointmap) | npm | 2.1.0, 3.0.0 |
| [nbmolviz-js](https://dependencywatch.io/package/npm/nbmolviz-js) | npm | 0.0.1 |
| [postcss-property-rollup](https://dependencywatch.io/package/npm/postcss-property-rollup) | npm | 0.0.1 |
| [procwire](https://dependencywatch.io/package/npm/procwire) | npm | 1.3.0, 2.0.0 |
| [quoting](https://dependencywatch.io/package/npm/quoting) | npm | 0.1.0 |
| [rebrandly-domains-digger](https://dependencywatch.io/package/npm/rebrandly-domains-digger) | npm | 9999.0.0 |
| [rebrandly-domains-search-client](https://dependencywatch.io/package/npm/rebrandly-domains-search-client) | npm | 9999.0.0 |
| [rs-biginteger](https://dependencywatch.io/package/npm/rs-biginteger) | npm | 6.1.3, 6.1.5 |
| [setup-cicd](https://dependencywatch.io/package/npm/setup-cicd) | npm | 0.0.1 |
| [terminal-prettier](https://dependencywatch.io/package/npm/terminal-prettier) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9 |
| [ts-lint-builders-v2.1](https://dependencywatch.io/package/npm/ts-lint-builders-v2.1) | npm | 2.1.0 |
| [ts-linting-builder](https://dependencywatch.io/package/npm/ts-linting-builder) | npm | 2.1.2 |

## What happened

Between 2026-06-30 14:08 UTC and 16:17 UTC, GitHub's Advisory Database published a batch of roughly 25 malware advisories against npm packages that had been sitting on the registry for hours to months. All records use CWE-506 (Embedded Malicious Code) with the standard "any computer that installed or ran this package should be considered fully compromised - rotate all secrets from a different device" boilerplate. No payload write-up is included in the GHSA text for any of them, so defenders should treat the install-time behaviour as unanalysed and assume worst case.

## Sub-cluster taxonomy

- **Chai typosquats.** `chai-as-persisted` and `chai-as-assured` fuse `chai-as-promised` (the go-to plugin for asserting on promises, ~5M weekly downloads) with plausible-sounding suffixes. Both packages ship two high-semver releases (`4.2.8` / `6.1.9` and `6.0.4` / `7.1.2` respectively), matching the "pretend to be a mature package" tactic used by the June 26 `pino-zod@1.0.121` typosquat.
- **`brock-*` pair.** `brock-loader@1.9.9` and `brock-react-alerts@1.99.99` / `9999.0.0` - the `9999.0.0` tag is the classic dependency-confusion resolution-winning SemVer used by the June 29 internal-scope batch (`@deel-ui/animation`, `@citi-icg-171632/citicms-repo-component`).
- **`rebrandly-domains-*` pair.** Both `rebrandly-domains-search-client@9999.0.0` and `rebrandly-domains-digger@9999.0.0` - dependency-confusion squats against what looks like a Rebrandly-owned internal SDK scope for their URL-shortener / branded-domain product.
- **Confluent Kafka client typosquat.** `confluent-kafka-javascript@0.0.1` - the legitimate name is scoped: `@confluentinc/kafka-javascript`. Attackers routinely publish the unscoped variant of a well-known scoped package.
- **`postcss-*` typosquat.** `postcss-property-rollup@0.0.1` - extends the pattern already documented in the 2026-06-26 pump/pino/rollup sweep (`rollup-plugin-polyfill-connect`) and the 2026-06-22 JFrog PostCSS-RAT campaign.
- **`terminal-prettier` brand.** 20+ published versions dating back to 2025-11 - this is a long-running typosquat "brand" (of `prettier`) rather than a same-day push. GHSA classifies the entire package as malware; any consumer that ever pinned any published version is in scope.
- **`ts-linting-builder@2.1.2` + `ts-lint-builders-v2.1@2.1.0`.** Paired typosquats against `tslint` / `ts-lint-plugin-*` - the `v2.1` suffix in the name is an unusual pattern that suggests they were designed to match a specific pinned version string in a CI script or Dockerfile.
- **Standalone malicious names.** `rs-biginteger` (6.1.3, 6.1.5), `quoting` (0.1.0), `procwire` (1.3.0, 2.0.0), `endpointmap` (2.1.0, 3.0.0), `agent-starter-pack@0.0.1`, `setup-cicd@0.0.1`, `nbmolviz-js@0.0.1` - no obvious upstream target for these; likely low-volume standalone malware pushes that a security researcher flagged and reported together.

## Overlap with existing DependencyWatch entries

- `livekit-agents` (also in this GHSA batch) is already tracked in the 2026-06-27 `livekit-agents.xyz` incident; this entry does not repeat those versions.
- `chai-as-persisted` is separately tracked in the 2026-06-27 `chai-as-persisted-jsonspack` incident for the `1.0.0` first-drop; the June 30 GHSA covers newly-visible `4.2.8` / `6.1.9` releases under the same package name.

## Attribution

GitHub does not attribute the batch, and no single security vendor has published a research post as of 2026-07-01. The mix of dependency-confusion `9999.0.0` tags, typosquat semver drift, and long-lived "brand" packages suggests the batch is a triage of several unrelated reports processed on the same day, not one coordinated operator.

## Impact

- Any host that installed any of the listed packages should be treated as fully compromised - every GHSA record uses the standard "rotate all secrets from a different computer" language
- `brock-react-alerts@9999.0.0` and both `rebrandly-domains-search-client@9999.0.0` / `rebrandly-domains-digger@9999.0.0` follow the internal-scope dependency-confusion playbook (matches the 2026-06-29 Deel/Webda/Citi cluster) - CI pipelines that resolve unscoped `brock-*` or `rebrandly-domains-*` names against the public registry would have pulled the malicious tarball instead of a private mirror release
- `chai-as-persisted` and `chai-as-assured` typosquat the widely-used `chai-as-promised` Chai plugin (~5M weekly downloads); dual name-fuse (`persisted`, `assured` - both plausible chai-adjacent slugs) suggests one operator hedging autocomplete drift
- `confluent-kafka-javascript@0.0.1` typosquats Confluent's official `@confluentinc/kafka-javascript` client (dropped scope prefix) - targets Kafka producer / consumer environments where the maintainer might paste an unscoped name into `package.json`
- `postcss-property-rollup@0.0.1` extends the ongoing `postcss-*` typosquat wave (see the 2026-06-22 JFrog PostCSS-RAT and 2026-06-26 pump/pino/rollup sweep)
- `terminal-prettier` shipped 20+ versions over several months, indicating a matured typosquat brand of the `prettier` code formatter rather than a one-off push

## What to do

1. Remove every reference to any package listed in the packages map below from `package.json`, lockfiles, CI image layers, and committed `node_modules`
2. If your build ever resolved `9999.0.0` of `brock-react-alerts`, `rebrandly-domains-search-client`, or `rebrandly-domains-digger` against the public registry: treat the build runner and any artefact it produced as compromised - rotate every credential reachable from that runner from a separate clean device
3. Kafka pipelines: reinstall with the correct scoped name `@confluentinc/kafka-javascript`; the flat name `confluent-kafka-javascript` is the malware slot
4. Postcss users: audit for `postcss-property-rollup` in lockfiles; the legitimate slug is either `postcss` (core) or a specific first-party plugin under the `postcss-*` scope
5. Rebrandly users: internal builds should route the `rebrandly-*` scope to your private mirror only - the public-registry names are now unpublished but the campaign pattern continues
6. Verify none of the listed packages resolves via your private mirror - many internal Artifactory / Nexus / Verdaccio instances cache npm tarballs and will continue to serve the malicious version after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-xm5w-w96q-42f3 - rs-biginteger malware advisory](https://github.com/advisories/GHSA-xm5w-w96q-42f3) - GitHub
- [GHSA-x8q6-66jr-wmp3 - quoting malware advisory](https://github.com/advisories/GHSA-x8q6-66jr-wmp3) - GitHub
- [GHSA-4wm6-vmww-2544 - chai-as-persisted malware advisory](https://github.com/advisories/GHSA-4wm6-vmww-2544) - GitHub
- [GHSA-m282-3m8c-qjwj - chai-as-assured malware advisory](https://github.com/advisories/GHSA-m282-3m8c-qjwj) - GitHub
- [GHSA-gh2m-x2qr-m2cm - brock-react-alerts malware advisory](https://github.com/advisories/GHSA-gh2m-x2qr-m2cm) - GitHub
- [GHSA-gwv3-x257-r43c - brock-loader malware advisory](https://github.com/advisories/GHSA-gwv3-x257-r43c) - GitHub
- [GHSA-6q7q-73w8-xvcf - rebrandly-domains-search-client malware advisory](https://github.com/advisories/GHSA-6q7q-73w8-xvcf) - GitHub
- [GHSA-44wx-4683-p2h3 - rebrandly-domains-digger malware advisory](https://github.com/advisories/GHSA-44wx-4683-p2h3) - GitHub
- [GHSA-x676-qqgj-qfgg - agent-starter-pack malware advisory](https://github.com/advisories/GHSA-x676-qqgj-qfgg) - GitHub
- [GHSA-5rc3-r829-w347 - setup-cicd malware advisory](https://github.com/advisories/GHSA-5rc3-r829-w347) - GitHub
- [GHSA-fc4r-p4fh-6h4p - nbmolviz-js malware advisory](https://github.com/advisories/GHSA-fc4r-p4fh-6h4p) - GitHub
- [GHSA-6g2x-2f5c-wp9w - postcss-property-rollup malware advisory](https://github.com/advisories/GHSA-6g2x-2f5c-wp9w) - GitHub
- [GHSA-j28m-58xp-3wgh - confluent-kafka-javascript malware advisory](https://github.com/advisories/GHSA-j28m-58xp-3wgh) - GitHub
- [GHSA-8mpj-272v-jhv7 - ts-linting-builder malware advisory](https://github.com/advisories/GHSA-8mpj-272v-jhv7) - GitHub
- [GHSA-vjgf-xg3j-g9c5 - ts-lint-builders-v2.1 malware advisory](https://github.com/advisories/GHSA-vjgf-xg3j-g9c5) - GitHub
- [GHSA-m8cr-hv9p-pg3f - terminal-prettier malware advisory](https://github.com/advisories/GHSA-m8cr-hv9p-pg3f) - GitHub
- [GHSA-5r42-357x-f2mx - procwire malware advisory](https://github.com/advisories/GHSA-5r42-357x-f2mx) - GitHub
- [GHSA-p3qr-5g48-8w89 - endpointmap malware advisory](https://github.com/advisories/GHSA-p3qr-5g48-8w89) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-06-30-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-06-30-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).