# GitHub Advisory malware sweep - 14 npm packages (TypeScript/API util family, SQL/node-cloud scoped cluster, `@lodash-en` typosquat) taken down 2026-07-03

> On 2026-07-03 GitHub's Advisory Database dropped 14 CWE-506 *Embedded Malicious Code* advisories against npm packages, all retired inside a ~30-minute window (15:36–16:06 UTC). The sweep spans three distinct micro-clusters: an unscoped `*-node-utils` / `*-api-*` TypeScript/API-helper family (5 packages, 20+ versions), a SQL-and-cloud scoped cluster on personal namespaces (`@sql-access/`, `@sqlite-node/`, `@sql-trigger/`, `@node-cloud/`), and three miscellaneous typosquats including `@lodash-en/lodash-en`. npm replaced every name with `0.0.1-security`.

- Published: 2026-07-03
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 14 packages, 73 compromised versions
- Tags: typosquat, credential-theft
- Also known as: 2026-07-03 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-03-ghsa-malware-sweep

## Affected packages (14)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@antoncarlos1/nodelamp](https://dependencywatch.io/package/npm/@antoncarlos1/nodelamp) | npm | 1.0.0, 1.0.1 |
| [@jacobtan/decode-sdk](https://dependencywatch.io/package/npm/@jacobtan/decode-sdk) | npm | 1.0.0 |
| [@lodash-en/lodash-en](https://dependencywatch.io/package/npm/@lodash-en/lodash-en) | npm | 1.4.11, 1.5.0 |
| [@node-cloud/create](https://dependencywatch.io/package/npm/@node-cloud/create) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [@sql-access/nodesql](https://dependencywatch.io/package/npm/@sql-access/nodesql) | npm | 1.0.0, 1.0.3, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9 |
| [@sql-trigger/nodesql](https://dependencywatch.io/package/npm/@sql-trigger/nodesql) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [@sqlite-node/createsql](https://dependencywatch.io/package/npm/@sqlite-node/createsql) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.7 |
| [alder_morrgan](https://dependencywatch.io/package/npm/alder_morrgan) | npm | 1.0.0, 1.0.1 |
| [api-node-utils](https://dependencywatch.io/package/npm/api-node-utils) | npm | 2.2.4 |
| [api-ts-utils](https://dependencywatch.io/package/npm/api-ts-utils) | npm | 1.0.0, 2.1.3, 2.1.4, 3.2.1, 3.2.2, 3.4.7, 3.4.8, 3.4.9, 3.5.9 |
| [decode-sdks](https://dependencywatch.io/package/npm/decode-sdks) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [ts-node-utils](https://dependencywatch.io/package/npm/ts-node-utils) | npm | 8.0.1, 8.0.4, 8.0.6 |
| [typescript-util-core](https://dependencywatch.io/package/npm/typescript-util-core) | npm | 3.5.0, 7.1.3, 7.1.5, 7.1.6 |
| [web-api-node](https://dependencywatch.io/package/npm/web-api-node) | npm | 1.3.2, 1.3.3 |

## What happened

Between 2026-07-03 15:36 UTC and 16:06 UTC - a tight ~30-minute window - GitHub's Advisory Database published 14 malware advisories against npm packages. Every record uses CWE-506 (Embedded Malicious Code) with the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-up is included in any of the GHSA texts, so defenders should treat the install-time behaviour as unanalysed and assume worst case for anything that reached a build host.

## Three micro-clusters, one sweep

The 14 advisories cluster into three groups by naming and time:

- **15:57–16:06 UTC - TypeScript/API utility family (5 unscoped packages).** `api-node-utils@2.2.4`, `api-ts-utils@1.0.0`→`3.5.9` (9 versions), `web-api-node@1.3.2`/`1.3.3`, `ts-node-utils@8.0.1`/`8.0.4`/`8.0.6`, `typescript-util-core@3.5.0`→`7.1.6` (4 versions). All published 2026-04-22 → 2026-05-04, all retired within the same 9-minute window on 2026-07-03. The name shapes - generic `*-node-utils` / `*-api-*` - read as one operator farming the "TypeScript/Node utility helper" naming space with plausible drop-in slugs.
- **15:57–15:58 UTC - SQL / node-cloud scoped cluster (4 scoped packages).** `@sql-access/nodesql` (17 versions, 2026-06-02 → 2026-06-23), `@sqlite-node/createsql` (16 versions, 2026-06-03 → 2026-06-23), `@sql-trigger/nodesql` (3 versions, 2026-06-03 → 2026-06-23), `@node-cloud/create` (7 versions, 2026-06-03 → 2026-06-29). Each scope hosts exactly one package - throwaway namespaces sized to hold one malware slot each. The near-daily republish cadence (16 versions in 21 days for `@sqlite-node/createsql`) is characteristic of a persistence-driven operator rebuilding after every automated npm flag.
- **15:36–15:57 UTC - Miscellaneous typosquats (5 packages).** `@jacobtan/decode-sdk@1.0.0` (2026-02-21), `decode-sdks@1.0.0`→`1.0.3` (2026-02-21), `@lodash-en/lodash-en@1.4.11`/`1.5.0` (2026-03-04), `alder_morrgan@1.0.0`/`1.0.1` (2025-12-01), `@antoncarlos1/nodelamp@1.0.0`/`1.0.1` (2026-06-02). Longest-lived member: `alder_morrgan` at 7 months. `@lodash-en/lodash-en` is the sweep's clearest brand collision - a scoped fake-lodash slug that has been live since March.

## Contrast with the 2026-07-02 sweep

The [2026-07-02 GHSA sweep](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep) retired 9 packages across three sub-clusters (Tailwind/Animate.css typosquats, `db-*` / `cache-*` fake-utility quartet, `vitest-agent`, `@modhamanish/rn-mm-template`) with take-down bursts spread over ~5 hours. The 2026-07-03 sweep compresses 14 retirements into ~30 minutes - GitHub is clearly triaging these as bulk reports rather than one-by-one confirmations. Combined July 2026 npm-malware count for just the first three days: 32 packages across 23 advisories.

## Attribution and downstream links

No campaign attribution is public for any of the 14 packages as of 2026-07-04. The tight time clustering and the shared "unremarkable utility slug" pattern suggests either a single operator or a small ring, but the GHSA texts do not name a threat actor and no vendor (Socket, JFrog, Phylum, Wiz, Aikido) has published a write-up specific to this sweep yet. Whether any of these packages tie back to Miasma / TeamPCP / Hades / the SafeDep-tracked `oob.moika.tech` family that has driven most 2026 npm malware activity is not established in public research as of 2026-07-04.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs remain fetchable from the CDN as of 2026-07-04 and should be treated as live malware in any lockfile hit - the CDN retention window for withdrawn npm versions typically runs 24–72 hours after the security replacement lands.

## Impact

- Any host that installed any of the 14 listed packages should be treated as fully compromised - every GHSA record uses the boilerplate "rotate all secrets from a different computer" language and no patched version exists
- The `api-ts-utils`, `ts-node-utils`, `typescript-util-core`, `web-api-node`, and `api-node-utils` family was published between 2026-04-22 and 2026-05-04 - up to 73 days sat in the registry before the 2026-07-03 GHSA take-down. `api-ts-utils` alone shipped 9 versions in a 12-day burst (`1.0.0` → `3.5.9`, 2026-04-22 → 2026-05-04) - anyone who resolved this family in Q2 2026 should assume compromise for that build host
- `@lodash-en/lodash-en@1.4.11` / `1.5.0` typosquats the ubiquitous [`lodash`](https://www.npmjs.com/package/lodash) utility library (~40M weekly downloads) by hiding under a fake "lodash-en" scope - a plausible slug for an "English-language lodash fork" that a developer might paste in without a second look. The versions shipped 2026-03-04, sitting live for ~4 months before take-down
- The scoped SQL cluster (`@sql-access/nodesql`, `@sqlite-node/createsql`, `@sql-trigger/nodesql`, `@node-cloud/create`) shipped 40+ combined versions between 2026-06-02 and 2026-06-29 - near-daily republish cadence typical of a persistence-driven malware operator rebuilding after each npm auto-flag. `@sql-access/nodesql` and `@sqlite-node/createsql` each shipped 16–17 versions, both hitting `1.1.x` before the take-down
- `decode-sdks` (unscoped) + `@jacobtan/decode-sdk` (scoped) are paired by name - same "decode SDK" concept, same 2026-02-21 publish date - and were retired within 24 seconds of each other (15:36:53 UTC → 15:37 UTC). Both were live for ~4.5 months before take-down; anyone who resolved either between Feb and July 2026 should treat the build host as compromised
- `alder_morrgan@1.0.0` / `1.0.1` (snake_case, unusual) shipped 2025-12-01 - the oldest in the sweep at 7 months live. The publisher chose an unusual name convention that would slip typosquat scanners looking for standard kebab-case brand collisions

## What to do

1. Remove every reference to any package in the packages map below from `package.json`, lockfiles, CI image layers, and committed `node_modules`
2. If your build ever resolved any of the `*-node-utils`, `*-ts-utils`, `*-api-*` names in Q2 2026: these are not legitimate utility libraries - the mainstream slugs are `ts-node`, `tsx`, and `@types/node`. Rotate every credential the build runner could reach from a separate clean device
3. The legitimate lodash package is `lodash` (unscoped), and its English-language docs live at `lodash.com` - `@lodash-en/lodash-en` is not a lodash publisher scope. Any lockfile that references it should be treated as a supply-chain incident
4. If you resolved `decode-sdks` or `@jacobtan/decode-sdk` between 2026-02-21 and 2026-07-03: 4.5 months of live time - assume long-running exfil from anything the build host could reach. Rotate every credential and re-image the build runner
5. Verify none of the 14 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will continue to serve the malicious versions after the public yank
6. Add the `*-node-utils`, `*-api-*`, `@sql-*`, `@sqlite-node`, `@node-cloud`, and `@lodash-*` name prefixes to a package-name allowlist review gate - the naming space around generic TypeScript / SQL / cloud helpers is being farmed for typosquats and personal-scope malware slots

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-mjvg-2r5j-mg76 - ts-node-utils malware advisory](https://github.com/advisories/GHSA-mjvg-2r5j-mg76) - GitHub
- [GHSA-84mg-p866-528x - typescript-util-core malware advisory](https://github.com/advisories/GHSA-84mg-p866-528x) - GitHub
- [GHSA-j69c-7q52-h87f - web-api-node malware advisory](https://github.com/advisories/GHSA-j69c-7q52-h87f) - GitHub
- [GHSA-3w2r-9f5g-prj8 - api-ts-utils malware advisory](https://github.com/advisories/GHSA-3w2r-9f5g-prj8) - GitHub
- [GHSA-wj6w-3grq-735j - api-node-utils malware advisory](https://github.com/advisories/GHSA-wj6w-3grq-735j) - GitHub
- [GHSA-j23f-jg9h-gjmc - alder_morrgan malware advisory](https://github.com/advisories/GHSA-j23f-jg9h-gjmc) - GitHub
- [GHSA-qpx3-6fx4-259q - @sql-access/nodesql malware advisory](https://github.com/advisories/GHSA-qpx3-6fx4-259q) - GitHub
- [GHSA-558p-3gxf-hm84 - @node-cloud/create malware advisory](https://github.com/advisories/GHSA-558p-3gxf-hm84) - GitHub
- [GHSA-9f9w-wg5j-m53j - @sql-trigger/nodesql malware advisory](https://github.com/advisories/GHSA-9f9w-wg5j-m53j) - GitHub
- [GHSA-9w2p-6gjc-vrqv - @sqlite-node/createsql malware advisory](https://github.com/advisories/GHSA-9w2p-6gjc-vrqv) - GitHub
- [GHSA-c3r7-wcqm-j4v8 - @antoncarlos1/nodelamp malware advisory](https://github.com/advisories/GHSA-c3r7-wcqm-j4v8) - GitHub
- [GHSA-37qp-frv4-562v - @lodash-en/lodash-en malware advisory](https://github.com/advisories/GHSA-37qp-frv4-562v) - GitHub
- [GHSA-gv37-287r-g9vx - decode-sdks malware advisory](https://github.com/advisories/GHSA-gv37-287r-g9vx) - GitHub
- [GHSA-3mg6-vg6x-m62v - @jacobtan/decode-sdk malware advisory](https://github.com/advisories/GHSA-3mg6-vg6x-m62v) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).