# GitHub Advisory malware sweep - 9 npm packages (tailwind/animate typosquats, db-* cluster, `vitest-agent`) taken down 2026-07-02

> On 2026-07-02 GitHub's Advisory Database dropped 9 CWE-506 *Embedded Malicious Code* advisories against npm packages published between 2026-05-24 and 2026-07-01. Three distinct micro-clusters were retired within minutes of each other: a Tailwind/animate typosquat trio (`animatecss-postcss-plugin`, `tailwind-animates`, `tailwind-typography-stylecss`), a `db-*` / `cache-*` fake-utility quartet, and the standalone `vitest-agent` Vitest typosquat plus one scoped React Native template. npm replaced every name with a `0.0.1-security` holding tarball.

- Published: 2026-07-02
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 9 packages, 22 compromised versions
- Tags: typosquat, credential-theft
- Also known as: 2026-07-02 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-02-ghsa-malware-sweep

## Affected packages (9)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@modhamanish/rn-mm-template](https://dependencywatch.io/package/npm/@modhamanish/rn-mm-template) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1, 1.1.2, 1.1.3 |
| [animatecss-postcss-plugin](https://dependencywatch.io/package/npm/animatecss-postcss-plugin) | npm | 1.0.0, 1.0.1 |
| [cache-section-helper](https://dependencywatch.io/package/npm/cache-section-helper) | npm | 1.0.7 |
| [db-connector-log](https://dependencywatch.io/package/npm/db-connector-log) | npm | 1.0.0, 1.0.1 |
| [db-convertor](https://dependencywatch.io/package/npm/db-convertor) | npm | 1.0.5 |
| [db-plog](https://dependencywatch.io/package/npm/db-plog) | npm | 1.0.0, 1.0.1 |
| [tailwind-animates](https://dependencywatch.io/package/npm/tailwind-animates) | npm | 1.0.1 |
| [tailwind-typography-stylecss](https://dependencywatch.io/package/npm/tailwind-typography-stylecss) | npm | 0.8.3 |
| [vitest-agent](https://dependencywatch.io/package/npm/vitest-agent) | npm | 1.0.0, 1.0.5, 1.0.6 |

## What happened

Between 2026-07-02 09:47 UTC and 14:55 UTC, GitHub's Advisory Database published 9 malware advisories against npm packages. Every record uses CWE-506 (Embedded Malicious Code) with the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-up is included in any of the GHSA texts, so defenders should treat the install-time behaviour as unanalysed and assume worst case for anything that reached a build host.

## Three take-down bursts within five hours

The 9 advisories cluster into three distinct time buckets, and each bucket read as its own report:

- **09:47 UTC - `vitest-agent`** (`GHSA-w2r4-4x6j-3h5x`). Three versions (`1.0.0` published 2026-06-25, `1.0.5` and `1.0.6` both 2026-07-01) taken down within 24 hours of the last push. Straight-up Vitest typosquat.
- **13:16 UTC - `db-*` / `cache-*` quartet.** `db-convertor@1.0.5`, `db-connector-log@1.0.0` + `1.0.1`, `cache-section-helper@1.0.7`, `db-plog@1.0.0` + `1.0.1` - GHSA advisories `GHSA-p467-3jcx-48q5`, `GHSA-w7hw-9wmw-hj5w`, `GHSA-wg39-m2jm-wxhp`, `GHSA-j49r-84jx-vq3m` published within a 20-second window. Package upload dates span 2026-06-10 → 2026-06-30, so the operator sat on the registry for up to 22 days before the yank.
- **14:55 UTC - Tailwind / Animate.css typosquat trio.** `animatecss-postcss-plugin@1.0.0` + `1.0.1` (both 2026-06-02), `tailwind-animates@1.0.1` (2026-06-03), `tailwind-typography-stylecss@0.8.3` (2026-05-24) - GHSA `GHSA-p6ch-cw7w-ff5c`, `GHSA-3cr6-gpr8-pjfm`, `GHSA-p258-w6jm-c6ff` published within a 30-second window. All three names collide with legitimate CSS-tooling brands: `tailwindcss-animate` (singular), `@tailwindcss/typography`, and `postcss-preset-env` are the correct spellings.

The fourth ID in the same window - `@modhamanish/rn-mm-template@≤1.1.3` (`GHSA-7v96-p295-826q`) - does not fit any of the three sub-clusters. The scope is a personal namespace, and the package published 8+ visible versions across 5 months (2026-01-02 → 2026-05-15) before being flagged. The React Native "template" identity looks like a supply-chain long play rather than a same-week typosquat push.

## Overlap with prior sweeps

- The 2026-06-30 GHSA sweep (see [`npm-2026-06-30-ghsa-malware-sweep`](https://dependencywatch.io/incident/npm-2026-06-30-ghsa-malware-sweep)) yanked `postcss-property-rollup`, `chai-as-persisted`, `chai-as-assured`, and 15 other CSS / typosquat brands under the same CWE-506 template. The 2026-07-02 sweep continues the same triage cadence - GitHub is retiring these in daily-to-every-other-day batches, and the total July 2026 npm-malware count is on track to exceed the June sweep.
- No campaign attribution is public for any of the 9 packages. The Tailwind trio's tight 30-second GHSA window and the `db-*` quartet's 20-second window suggest coordinated single-actor reports rather than a mass sweep of unrelated submissions. Whether either cluster ties back to Miasma / TeamPCP or the SafeDep-tracked `oob.moika.tech` dep-confusion family is not established in public research as of 2026-07-03.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. `tailwind-typography-stylecss@0.8.3` remains listed on the package page alongside the holding tarball, which is unusual - the historical version is still fetchable from the CDN as of 2026-07-03 and should be treated as live malware in any lockfile hit.

## Impact

- Any host that installed any of the listed packages should be treated as fully compromised - every GHSA record uses the boilerplate "rotate all secrets from a different computer" language and no patched version exists
- `vitest-agent@1.0.0` / `1.0.5` / `1.0.6` typosquats the widely-used [`vitest`](https://www.npmjs.com/package/vitest) test runner (~20M weekly downloads) - a plausible slug for a "vitest-adjacent CI helper" that a developer might paste into `package.json` without a second look
- `animatecss-postcss-plugin`, `tailwind-animates`, and `tailwind-typography-stylecss` piggy-back on the Tailwind CSS and Animate.css ecosystems - three parallel typosquats retired in the same 30-second window on 2026-07-02 (14:55 UTC) suggest one operator hedging autocomplete drift across three CSS-tooling naming spaces
- The `db-*` quartet (`db-convertor`, `db-connector-log`, `db-plog`, `cache-section-helper`) shipped on 2026-06-10 → 2026-06-30 and were all retired in a single 20-second GHSA burst on 2026-07-02 (13:16 UTC) - the near-simultaneous take-down indicates GitHub triaged them as one report even though the names read as unrelated database / caching helpers
- `@modhamanish/rn-mm-template` shipped 8+ visible versions between 2026-01-02 and 2026-05-15 under a scoped React Native "template" identity before its 2026-07-02 take-down - a long-lived brand rather than a one-off push, which raises the odds that boilerplate-scanner CI ingested the malware at some point in that 5-month window

## What to do

1. Remove every reference to any package in the packages map below from `package.json`, lockfiles, CI image layers, and committed `node_modules`
2. If your build ever resolved `vitest-agent`: this is not a legitimate Vitest utility - the official test runner is `vitest`, and the `vitest-agent` slug is now the malware slot. Rotate every credential the build runner could reach from a separate clean device
3. CSS tooling: the legitimate Tailwind slugs are `tailwindcss`, `@tailwindcss/*`, and `tailwindcss-animate` (note the trailing singular `-animate`, not `-animates`). The legitimate PostCSS + Animate.css bridge is `animate.css` published under scope-free `animate.css` - never `animatecss-postcss-plugin`
4. React Native developers who pinned `@modhamanish/rn-mm-template` at any point in 2026-01 → 2026-05 should treat the build host as compromised, roll new Google Play / App Store signing keys from a separate clean device, and hunt for exfil to any host contacted during a `pod install` / `metro start` in that window
5. Verify none of the listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will continue to serve the malicious version after the public yank
6. Add the `vitest-agent`, `tailwind-animates`, `animatecss-postcss-plugin`, and `db-*` prefixes to a package-name allowlist review gate - the naming space around Vitest, Tailwind, and generic `db-*` helpers is being farmed for typosquats

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-p6ch-cw7w-ff5c - animatecss-postcss-plugin malware advisory](https://github.com/advisories/GHSA-p6ch-cw7w-ff5c) - GitHub
- [GHSA-3cr6-gpr8-pjfm - tailwind-animates malware advisory](https://github.com/advisories/GHSA-3cr6-gpr8-pjfm) - GitHub
- [GHSA-p258-w6jm-c6ff - tailwind-typography-stylecss malware advisory](https://github.com/advisories/GHSA-p258-w6jm-c6ff) - GitHub
- [GHSA-p467-3jcx-48q5 - db-convertor malware advisory](https://github.com/advisories/GHSA-p467-3jcx-48q5) - GitHub
- [GHSA-w7hw-9wmw-hj5w - db-connector-log malware advisory](https://github.com/advisories/GHSA-w7hw-9wmw-hj5w) - GitHub
- [GHSA-wg39-m2jm-wxhp - cache-section-helper malware advisory](https://github.com/advisories/GHSA-wg39-m2jm-wxhp) - GitHub
- [GHSA-j49r-84jx-vq3m - db-plog malware advisory](https://github.com/advisories/GHSA-j49r-84jx-vq3m) - GitHub
- [GHSA-w2r4-4x6j-3h5x - vitest-agent malware advisory](https://github.com/advisories/GHSA-w2r4-4x6j-3h5x) - GitHub
- [GHSA-7v96-p295-826q - @modhamanish/rn-mm-template malware advisory](https://github.com/advisories/GHSA-7v96-p295-826q) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).