# GitHub Advisory malware sweep - ~155 npm packages (logger/tailwind/eslint/bignumber typosquats, polymarket-onchain-* crypto-drainers) taken down 2026-07-06

> On 2026-07-06 GitHub's Advisory Database published ~155 CWE-506 *Embedded Malicious Code* advisories against npm packages - the largest single-day 2026 GHSA npm-malware sweep to date. The batch clusters into six naming families: chalk/pino/winston/`*-logger` pretty-print typosquats, tailwindcss/vite typosquats, eslint / `*-lint-*` helper squats, bignumber.js / crypto-math typosquats, chai `*-as-*` matcher squats, and two `polymarket-onchain-*` crypto-drainer slugs continuing the June cluster. npm replaced every name with `0.0.1-security`.

- Published: 2026-07-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 162 packages, 429 compromised versions
- Tags: typosquat, credential-theft, crypto-wallet-drain
- Also known as: 2026-07-06 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-06-ghsa-malware-sweep

## Affected packages (162)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@jaime9008/math-service](https://dependencywatch.io/package/npm/@jaime9008/math-service) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [argonflux](https://dependencywatch.io/package/npm/argonflux) | npm | 2.0.1 |
| [awesome-cli-logger](https://dependencywatch.io/package/npm/awesome-cli-logger) | npm | 1.0.0, 1.2.0 |
| [big-numer](https://dependencywatch.io/package/npm/big-numer) | npm | 5.0.5 |
| [big-numerate](https://dependencywatch.io/package/npm/big-numerate) | npm | 5.0.3 |
| [big-numerator](https://dependencywatch.io/package/npm/big-numerator) | npm | 5.0.3, 5.0.6 |
| [big256-ts](https://dependencywatch.io/package/npm/big256-ts) | npm | 5.0.3, 5.0.4 |
| [bigint.fs](https://dependencywatch.io/package/npm/bigint.fs) | npm | 5.0.5, 5.0.6 |
| [bigint.os](https://dependencywatch.io/package/npm/bigint.os) | npm | 5.0.5, 5.0.6, 5.0.7, 5.0.8 |
| [bjs-biginteger](https://dependencywatch.io/package/npm/bjs-biginteger) | npm | 5.0.5, 5.0.6 |
| [bjs-lint-builder](https://dependencywatch.io/package/npm/bjs-lint-builder) | npm | 1.0.5 |
| [bjs-lint-builders](https://dependencywatch.io/package/npm/bjs-lint-builders) | npm | 1.0.4, 1.0.5, 1.1.0 |
| [bn-eslint.js](https://dependencywatch.io/package/npm/bn-eslint.js) | npm | 8.0.5 |
| [bn-math](https://dependencywatch.io/package/npm/bn-math) | npm | 1.0.0, 1.0.1 |
| [bootstrap-utils](https://dependencywatch.io/package/npm/bootstrap-utils) | npm | 4.5.0, 5.1.1 |
| [btd-smart](https://dependencywatch.io/package/npm/btd-smart) | npm | 1.0.2, 1.0.3 |
| [bubblestr](https://dependencywatch.io/package/npm/bubblestr) | npm | 1.1.4 |
| [bytecore](https://dependencywatch.io/package/npm/bytecore) | npm | 5.3.1 |
| [chai-as-decrypted](https://dependencywatch.io/package/npm/chai-as-decrypted) | npm | 4.2.8 |
| [chai-as-init](https://dependencywatch.io/package/npm/chai-as-init) | npm | 1.4.5, 1.4.6, 1.4.7, 7.0.6 |
| [chai-as-polished](https://dependencywatch.io/package/npm/chai-as-polished) | npm | 7.0.8 |
| [chai-dec](https://dependencywatch.io/package/npm/chai-dec) | npm | 2.3.5 |
| [chai-guard](https://dependencywatch.io/package/npm/chai-guard) | npm | 1.0.0, 1.2.3 |
| [chain-await-test](https://dependencywatch.io/package/npm/chain-await-test) | npm | 1.3.5 |
| [chalk-logger-prettier](https://dependencywatch.io/package/npm/chalk-logger-prettier) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.7, 1.0.8 |
| [chalk-plus-ts](https://dependencywatch.io/package/npm/chalk-plus-ts) | npm | 1.0.3, 1.0.4 |
| [chalk-prettier](https://dependencywatch.io/package/npm/chalk-prettier) | npm | 1.0.8, 1.0.9 |
| [chalk-pro-logger](https://dependencywatch.io/package/npm/chalk-pro-logger) | npm | 1.1.1, 1.1.2 |
| [chalki-pretty](https://dependencywatch.io/package/npm/chalki-pretty) | npm | 1.0.0 |
| [chalks-logger](https://dependencywatch.io/package/npm/chalks-logger) | npm | 1.0.9, 1.1.0, 1.1.1, 1.1.2, 1.1.3 |
| [cjs-biginteger](https://dependencywatch.io/package/npm/cjs-biginteger) | npm | 5.0.3, 5.0.5, 5.0.6 |
| [classbreeze-utils](https://dependencywatch.io/package/npm/classbreeze-utils) | npm | 0.7.7, 0.7.8, 0.7.9, 0.7.10 |
| [color-cli-log](https://dependencywatch.io/package/npm/color-cli-log) | npm | 2.0.0, 2.1.0 |
| [color-logger-console](https://dependencywatch.io/package/npm/color-logger-console) | npm | 3.1.8, 3.1.9 |
| [competion](https://dependencywatch.io/package/npm/competion) | npm | 1.8.1, 1.8.2, 1.8.3, 1.8.4 |
| [cookie-ease](https://dependencywatch.io/package/npm/cookie-ease) | npm | 1.0.0, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.1, 1.1.2, 1.1.3, 1.1.5 |
| [custom-log-viewer](https://dependencywatch.io/package/npm/custom-log-viewer) | npm | 1.0.0 |
| [db-query-log](https://dependencywatch.io/package/npm/db-query-log) | npm | 1.0.1, 1.0.2 |
| [debug-glitzs](https://dependencywatch.io/package/npm/debug-glitzs) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [devkit-scripts](https://dependencywatch.io/package/npm/devkit-scripts) | npm | 1.0.0, 1.0.3 |
| [df-vision](https://dependencywatch.io/package/npm/df-vision) | npm | 0.0.1, 1.1.70, 1.1.71, 1.1.72, 1.1.73, 1.1.74, 1.1.75, 1.1.76, 1.1.77, 1.1.78, 1.1.79 |
| [dotenv-express](https://dependencywatch.io/package/npm/dotenv-express) | npm | 2.5.5, 17.4.2, 17.4.3, 17.4.4, 17.4.5, 17.4.6 |
| [elevate-log](https://dependencywatch.io/package/npm/elevate-log) | npm | 2.0.5 |
| [emojiprint-logger](https://dependencywatch.io/package/npm/emojiprint-logger) | npm | 1.1.0, 5.6.2 |
| [emojiprint-prettier](https://dependencywatch.io/package/npm/emojiprint-prettier) | npm | 1.0.9 |
| [env-axios](https://dependencywatch.io/package/npm/env-axios) | npm | 1.3.6 |
| [environment-gate](https://dependencywatch.io/package/npm/environment-gate) | npm | 7.3.5, 7.3.6 |
| [es-lint-builders](https://dependencywatch.io/package/npm/es-lint-builders) | npm | 1.0.0, 1.0.3, 1.0.4, 1.0.5 |
| [es-lint-entry](https://dependencywatch.io/package/npm/es-lint-entry) | npm | 1.0.0 |
| [eslint-helper](https://dependencywatch.io/package/npm/eslint-helper) | npm | 4.0.1, 4.0.2 |
| [eslint-vite](https://dependencywatch.io/package/npm/eslint-vite) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [eth-logger](https://dependencywatch.io/package/npm/eth-logger) | npm | 4.3.20, 4.3.21 |
| [eth-tick](https://dependencywatch.io/package/npm/eth-tick) | npm | 7.4.17, 7.4.18 |
| [ether-bn.js](https://dependencywatch.io/package/npm/ether-bn.js) | npm | 1.0.0, 1.0.3, 1.1.1, 1.2.1, 1.3.1, 1.3.3, 1.3.4, 1.4.0, 1.4.1 |
| [express-dotenv](https://dependencywatch.io/package/npm/express-dotenv) | npm | 1.3.5 |
| [express-guardrail](https://dependencywatch.io/package/npm/express-guardrail) | npm | 1.3.5, 1.4.1 |
| [express-initial](https://dependencywatch.io/package/npm/express-initial) | npm | 12.1.7, 12.1.8, 12.1.9, 12.1.10 |
| [express-session-js](https://dependencywatch.io/package/npm/express-session-js) | npm | 1.0.0, 1.19.0 |
| [fastnodemailer](https://dependencywatch.io/package/npm/fastnodemailer) | npm | 8.0.2, 8.0.3, 8.0.4 |
| [graphpilot](https://dependencywatch.io/package/npm/graphpilot) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 1.0.0 |
| [grid-settings-align](https://dependencywatch.io/package/npm/grid-settings-align) | npm | 14.1.1, 14.1.2 |
| [hjs-biginteger](https://dependencywatch.io/package/npm/hjs-biginteger) | npm | 5.0.5 |
| [hjs-lint-builders](https://dependencywatch.io/package/npm/hjs-lint-builders) | npm | 1.0.4 |
| [js-crypto-promise](https://dependencywatch.io/package/npm/js-crypto-promise) | npm | 1.0.1 |
| [js-unimode](https://dependencywatch.io/package/npm/js-unimode) | npm | 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10 |
| [jsontoken-extend](https://dependencywatch.io/package/npm/jsontoken-extend) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13 |
| [jsonupper](https://dependencywatch.io/package/npm/jsonupper) | npm | 1.0.0, 5.1.0 |
| [lint-builders](https://dependencywatch.io/package/npm/lint-builders) | npm | 1.0.0 |
| [lint-builds](https://dependencywatch.io/package/npm/lint-builds) | npm | 1.0.0, 1.0.5 |
| [lint-nule](https://dependencywatch.io/package/npm/lint-nule) | npm | 1.0.4 |
| [lint-nuler](https://dependencywatch.io/package/npm/lint-nuler) | npm | 1.0.4 |
| [lint-null](https://dependencywatch.io/package/npm/lint-null) | npm | 1.0.4 |
| [linter-entry](https://dependencywatch.io/package/npm/linter-entry) | npm | 1.0.0 |
| [log-format-thread](https://dependencywatch.io/package/npm/log-format-thread) | npm | 1.0.0, 1.0.1 |
| [log-upgrade](https://dependencywatch.io/package/npm/log-upgrade) | npm | 7.1.0 |
| [logger-beauty](https://dependencywatch.io/package/npm/logger-beauty) | npm | 1.0.1, 1.0.2, 1.0.3, 1.1.0, 2.1.1 |
| [metrica-chain](https://dependencywatch.io/package/npm/metrica-chain) | npm | 2.4.5 |
| [metrica-node](https://dependencywatch.io/package/npm/metrica-node) | npm | 2.4.5 |
| [mjs-biginteger](https://dependencywatch.io/package/npm/mjs-biginteger) | npm | 5.0.5, 5.0.6 |
| [modulyn](https://dependencywatch.io/package/npm/modulyn) | npm | 1.0.1 |
| [mongoose-json-format](https://dependencywatch.io/package/npm/mongoose-json-format) | npm | 3.0.0, 3.0.1 |
| [mongoose-lean-hooks](https://dependencywatch.io/package/npm/mongoose-lean-hooks) | npm | 0.5.2, 0.5.3, 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [motion-lib](https://dependencywatch.io/package/npm/motion-lib) | npm | 2.3.5 |
| [next-bignumber.js](https://dependencywatch.io/package/npm/next-bignumber.js) | npm | 1.0.0 |
| [node-env-detector](https://dependencywatch.io/package/npm/node-env-detector) | npm | 1.0.0, 1.0.1 |
| [nodepathbalance54](https://dependencywatch.io/package/npm/nodepathbalance54) | npm | 1.1.0 |
| [normalize-path-seq](https://dependencywatch.io/package/npm/normalize-path-seq) | npm | 3.8.9 |
| [npm-doc-dev](https://dependencywatch.io/package/npm/npm-doc-dev) | npm | 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.1.0, 1.1.1 |
| [npm-eslint-helper](https://dependencywatch.io/package/npm/npm-eslint-helper) | npm | 1.0.1 |
| [older_morgan](https://dependencywatch.io/package/npm/older_morgan) | npm | 1.0.1, 1.0.2 |
| [peptideenv](https://dependencywatch.io/package/npm/peptideenv) | npm | 16.6.1, 16.6.2, 16.6.3, 16.6.4, 16.6.5, 16.6.6 |
| [picocolor-logger](https://dependencywatch.io/package/npm/picocolor-logger) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [pino-formatter](https://dependencywatch.io/package/npm/pino-formatter) | npm | 1.1.12, 1.1.13 |
| [pino-pretty-logs](https://dependencywatch.io/package/npm/pino-pretty-logs) | npm | 1.0.7, 1.0.8, 1.1.0, 2.0.0 |
| [pino-sdk-v2](https://dependencywatch.io/package/npm/pino-sdk-v2) | npm | 9.9.0 |
| [pino-utils](https://dependencywatch.io/package/npm/pino-utils) | npm | 1.3.6, 1.4.0 |
| [polymarket-onchain-plugin](https://dependencywatch.io/package/npm/polymarket-onchain-plugin) | npm | 2.1.3, 2.1.4, 2.1.5 |
| [polymarket-onchain-sdk](https://dependencywatch.io/package/npm/polymarket-onchain-sdk) | npm | 1.0.2, 1.0.3, 1.0.4 |
| [prettier-logger](https://dependencywatch.io/package/npm/prettier-logger) | npm | 0.1.4, 0.1.5, 0.1.6 |
| [pretty-pino-logger](https://dependencywatch.io/package/npm/pretty-pino-logger) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 2.0.1, 2.0.2 |
| [pretty-pino-loggers](https://dependencywatch.io/package/npm/pretty-pino-loggers) | npm | 1.0.1 |
| [random-string-64](https://dependencywatch.io/package/npm/random-string-64) | npm | 1.0.0, 1.0.1 |
| [react-check-error](https://dependencywatch.io/package/npm/react-check-error) | npm | 2.1.6, 2.1.7 |
| [react-native-template-my-starter](https://dependencywatch.io/package/npm/react-native-template-my-starter) | npm | 1.0.0 |
| [react-next-dom](https://dependencywatch.io/package/npm/react-next-dom) | npm | 1.0.0, 1.1.7, 17.2.7, 17.2.8 |
| [react-svg-render](https://dependencywatch.io/package/npm/react-svg-render) | npm | 1.0.2 |
| [renderctx](https://dependencywatch.io/package/npm/renderctx) | npm | 1.1.1 |
| [request-js-validator](https://dependencywatch.io/package/npm/request-js-validator) | npm | 1.0.2, 1.0.3, 1.0.4 |
| [rma-utils](https://dependencywatch.io/package/npm/rma-utils) | npm | 1.0.1 |
| [rollup-plugin-polyfill-handler](https://dependencywatch.io/package/npm/rollup-plugin-polyfill-handler) | npm | 1.0.0, 1.0.1 |
| [router-kit](https://dependencywatch.io/package/npm/router-kit) | npm | 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.5, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.2.6, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 2.0.0, 2.0.1, 2.1.0 |
| [safe-validate](https://dependencywatch.io/package/npm/safe-validate) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [secure-box](https://dependencywatch.io/package/npm/secure-box) | npm | 1.0.1, 1.0.2 |
| [set-proto-chain](https://dependencywatch.io/package/npm/set-proto-chain) | npm | 1.0.3 |
| [sjs-biginteger](https://dependencywatch.io/package/npm/sjs-biginteger) | npm | 5.0.5, 5.0.6 |
| [sjs-builder](https://dependencywatch.io/package/npm/sjs-builder) | npm | 1.0.4, 1.0.5 |
| [sjs-builders](https://dependencywatch.io/package/npm/sjs-builders) | npm | 1.0.4 |
| [sjs-lint-build1](https://dependencywatch.io/package/npm/sjs-lint-build1) | npm | 1.0.4 |
| [sleek-pretty](https://dependencywatch.io/package/npm/sleek-pretty) | npm | 1.0.0 |
| [sol-sdk](https://dependencywatch.io/package/npm/sol-sdk) | npm | 2.3.18 |
| [st-biginteger](https://dependencywatch.io/package/npm/st-biginteger) | npm | 5.0.5 |
| [st-bigintr](https://dependencywatch.io/package/npm/st-bigintr) | npm | 5.0.5, 5.0.6 |
| [stacknova](https://dependencywatch.io/package/npm/stacknova) | npm | 1.0.0 |
| [styled-text-logger](https://dependencywatch.io/package/npm/styled-text-logger) | npm | 1.3.1 |
| [subsearch](https://dependencywatch.io/package/npm/subsearch) | npm | 1.0.2, 1.0.3 |
| [syncora](https://dependencywatch.io/package/npm/syncora) | npm | 0.2.0, 3.5.7 |
| [tailstyle-core](https://dependencywatch.io/package/npm/tailstyle-core) | npm | 0.0.1 |
| [tailwind-fonttype-inter](https://dependencywatch.io/package/npm/tailwind-fonttype-inter) | npm | 2.3.2 |
| [tailwind-scroller](https://dependencywatch.io/package/npm/tailwind-scroller) | npm | 1.0.2 |
| [tailwind-typography-plus](https://dependencywatch.io/package/npm/tailwind-typography-plus) | npm | 2.1.0 |
| [tailwindcss-animatecss-latest](https://dependencywatch.io/package/npm/tailwindcss-animatecss-latest) | npm | 2.1.0, 2.1.1 |
| [tailwindcss-fonttype-inter](https://dependencywatch.io/package/npm/tailwindcss-fonttype-inter) | npm | 2.3.1, 2.3.2 |
| [tailwindcss-fonttypo-inter](https://dependencywatch.io/package/npm/tailwindcss-fonttypo-inter) | npm | 2.3.2 |
| [tailwindcss-framer-motion](https://dependencywatch.io/package/npm/tailwindcss-framer-motion) | npm | 1.1.3 |
| [tailwindcss-svg-helper](https://dependencywatch.io/package/npm/tailwindcss-svg-helper) | npm | 1.17.9, 1.18.0 |
| [test-prettier](https://dependencywatch.io/package/npm/test-prettier) | npm | 1.0.9 |
| [theta-connector](https://dependencywatch.io/package/npm/theta-connector) | npm | 1.0.0 |
| [theta-kit](https://dependencywatch.io/package/npm/theta-kit) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [ts-bigtn](https://dependencywatch.io/package/npm/ts-bigtn) | npm | 1.3.1, 1.3.2 |
| [ts-build-optimize](https://dependencywatch.io/package/npm/ts-build-optimize) | npm | 1.1.5, 1.1.6, 1.2.0, 1.2.1, 1.2.2 |
| [ts-eslint-helper](https://dependencywatch.io/package/npm/ts-eslint-helper) | npm | 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 |
| [ts-eslinter](https://dependencywatch.io/package/npm/ts-eslinter) | npm | 1.0.0 |
| [ts-lint-builders](https://dependencywatch.io/package/npm/ts-lint-builders) | npm | 1.0.5 |
| [ts-lint-builds](https://dependencywatch.io/package/npm/ts-lint-builds) | npm | 1.0.5 |
| [ts-relayer-pub](https://dependencywatch.io/package/npm/ts-relayer-pub) | npm | 1.0.0 |
| [ts-webplug](https://dependencywatch.io/package/npm/ts-webplug) | npm | 3.0.5, 3.0.6, 3.0.7, 3.0.8 |
| [tsliverhome](https://dependencywatch.io/package/npm/tsliverhome) | npm | 1.0.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 |
| [twcompose-utils](https://dependencywatch.io/package/npm/twcompose-utils) | npm | 0.7.6, 0.7.7 |
| [txs-data](https://dependencywatch.io/package/npm/txs-data) | npm | 1.0.1 |
| [typedecode](https://dependencywatch.io/package/npm/typedecode) | npm | 1.0.1, 1.0.2, 1.0.3 |
| [unique-id-64](https://dependencywatch.io/package/npm/unique-id-64) | npm | 1.0.0 |
| [vite-config-field](https://dependencywatch.io/package/npm/vite-config-field) | npm | 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5 |
| [vite-plugin-compress-js](https://dependencywatch.io/package/npm/vite-plugin-compress-js) | npm | 0.5.4, 0.5.5, 0.5.6, 0.5.7 |
| [vite-plugin-svg-paths](https://dependencywatch.io/package/npm/vite-plugin-svg-paths) | npm | 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9 |
| [web-pool](https://dependencywatch.io/package/npm/web-pool) | npm | 2.3.5 |
| [webpack-cache-clean](https://dependencywatch.io/package/npm/webpack-cache-clean) | npm | 0.1.4 |
| [webpack-patch](https://dependencywatch.io/package/npm/webpack-patch) | npm | 1.1.7, 1.1.8, 1.1.9, 1.2.0 |
| [wime-zle](https://dependencywatch.io/package/npm/wime-zle) | npm | 1.1.4 |
| [windrule-utils](https://dependencywatch.io/package/npm/windrule-utils) | npm | 0.0.1 |
| [winston-js-express](https://dependencywatch.io/package/npm/winston-js-express) | npm | 1.0.0, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.1, 1.1.2 |
| [winston-prism](https://dependencywatch.io/package/npm/winston-prism) | npm | 1.0.1 |
| [xnder-sdk-js](https://dependencywatch.io/package/npm/xnder-sdk-js) | npm | 0.1.0 |

## What happened

On 2026-07-06 GitHub's Advisory Database published ~155 CWE-506 (Embedded Malicious Code) advisories against npm packages - a single-day volume that dwarfs the individual mid-week sweeps ([2026-06-30](https://dependencywatch.io/incident/npm-2026-06-30-ghsa-malware-sweep) - 5 packages, [2026-07-02](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep) - 9 packages, [2026-07-03](https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep) - 14 packages) and appears to represent a bulk backlog processing action by GHSA staff. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-ups accompany any of the GHSA texts.

## Six naming clusters

### 1. Logger / pretty-print typosquats (~34 packages)

A sprawling cluster targeting the Node.js structured-logging vocabulary. `pino-utils`, `pino-formatter`, `pino-sdk-v2`, `pino-pretty-logs`, `pretty-pino-logger`, `pretty-pino-loggers` collide with the [`pino`](https://www.npmjs.com/package/pino) family. `winston-prism`, `winston-js-express` collide with [`winston`](https://www.npmjs.com/package/winston). `chalki-pretty`, `chalk-pro-logger`, `chalks-logger`, `chalk-logger-prettier`, `chalk-prettier`, `chalk-plus-ts` collide with [`chalk`](https://www.npmjs.com/package/chalk) + [`prettier`](https://www.npmjs.com/package/prettier). Add `picocolor-logger`, `custom-log-viewer`, `color-cli-log`, `color-logger-console`, `logger-beauty`, `awesome-cli-logger`, `emojiprint-logger`, `emojiprint-prettier`, `styled-text-logger`, `log-format-thread`, `log-upgrade`, `elevate-log`, `sleek-pretty`, `prettier-logger`. Every one of these is a plausible mistype or "prettier fork" that would slip past a lockfile review that only checks for exact-match brand names.

### 2. Tailwind / Vite / PostCSS typosquats (~11 packages)

Continuation of the [2026-07-02 sweep](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep) Tailwind theme. `tailwindcss-animatecss-latest@2.1.0`–`2.1.1`, `tailwindcss-fonttypo-inter@2.3.2`, `tailwindcss-fonttype-inter@2.3.1`–`2.3.2`, `tailwindcss-svg-helper@1.17.9`–`1.18.0`, `tailwindcss-framer-motion@1.1.3`, `tailwind-typography-plus@2.1.0`, `tailwind-fonttype-inter@2.3.2`, `tailwind-scroller@1.0.2`. Vite: `vite-plugin-svg-paths@1.1.5`–`1.1.9`, `vite-plugin-compress-js@0.5.4`–`0.5.7`, `vite-config-field@1.1.0`–`1.1.5`.

### 3. ESLint / lint-helper typosquats (~20 packages)

`ts-eslinter`, `ts-lint-builds`, `ts-lint-builders`, `ts-eslint-helper`, `bjs-lint-builder`, `bjs-lint-builders`, `sjs-lint-build1`, `hjs-lint-builders`, `es-lint-entry`, `es-lint-builders`, `eslint-vite`, `eslint-helper`, `lint-null`, `lint-nule`, `lint-nuler`, `lint-builds`, `lint-builders`, `linter-entry`, `npm-eslint-helper`, `test-prettier`. Naming pattern is a rebranding operator cycling through single-letter prefixes (`bjs-`, `sjs-`, `hjs-`, `cjs-`, `mjs-`) - same shape as the [2026-07-03 SQL cluster](https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep).

### 4. `bignumber.js` / crypto-math typosquats (~17 packages)

`bigint.os`, `bigint.fs`, `bn-eslint.js`, `bn-math`, `ether-bn.js`, `next-bignumber.js`, `big-numerator`, `big-numer`, `big-numerate`, `big256-ts`, and the prefixed set `sjs-biginteger`, `mjs-biginteger`, `cjs-biginteger`, `bjs-biginteger`, `hjs-biginteger`, `st-biginteger`, `st-bigintr`. Almost all versions cluster around `5.0.5`+ - the same starting version as the real [`bignumber.js`](https://www.npmjs.com/package/bignumber.js), giving the fakes a plausible "current version" if a developer skims npm search results.

### 5. Chai `*-as-*` matcher squats (5 packages)

`chai-guard`, `chai-dec`, `chai-as-init`, `chai-as-polished`, `chai-as-decrypted`. All plausibly typo `chai-as-promised`, the canonical async-assertion adapter. Same batch also includes `test-prettier` (fake Jest/Mocha helper).

### 6. Polymarket crypto-drainer continuation (2 packages)

`polymarket-onchain-sdk@1.0.2`–`1.0.4` and `polymarket-onchain-plugin@2.1.3`–`2.1.5` continue the [Polymarket brand-collision campaign](https://dependencywatch.io/incident/npm-2026-06-27-polymarket-clob-math-vercel-loader) tracked from 2026-06-27's `polymarket-clob-math` package. Same brand, different slugs - indicative of a persistent operator working the Polymarket wallet-drainer angle across weeks.

### 7. Miscellaneous (~65 packages)

The remainder is a long tail of individual typosquats and throwaway names: `argonflux`, `modulyn`, `syncora`, `stacknova`, `graphpilot`, `bytecore`, `peptideenv`, `fastnodemailer`, `bubblestr`, `subsearch`, `windrule-utils`, `typedecode`, `twcompose-utils`, `txs-data`, `theta-connector`, `theta-kit`, `tailstyle-core`, `rma-utils`, `sol-sdk`, `secure-box`, `set-proto-chain`, `router-kit`, `request-js-validator`, `react-svg-render`, `react-check-error`, `react-native-template-my-starter`, `react-next-dom`, `rollup-plugin-polyfill-handler`, `webpack-patch`, `webpack-cache-clean`, `motion-lib`, `df-vision`, `debug-glitzs`, `mongoose-json-format`, `mongoose-lean-hooks`, `metrica-node`, `metrica-chain`, `js-unimode`, `jsontoken-extend`, `jsonupper`, `js-crypto-promise`, `older_morgan`, `chain-await-test`, `bootstrap-utils`, `competion`, `btd-smart`, `cookie-ease`, `safe-validate`, `renderctx`, `classbreeze-utils`, `grid-settings-align`, `env-axios`, `environment-gate`, `express-guardrail`, `express-session-js`, `express-initial`, `express-dotenv`, `dotenv-express`, `db-query-log`, `devkit-scripts`, `eth-tick`, `eth-logger`, `node-env-detector`, `nodepathbalance54`, `normalize-path-seq`, `ts-webplug`, `ts-build-optimize`, `ts-bigtn`, `ts-relayer-pub`, `tsliverhome`, `npm-doc-dev`, `@jaime9008/math-service`, `xnder-sdk-js`, `web-pool`, `wime-zle`, `unique-id-64`, `random-string-64`. Some carry unusually long publish histories (`js-unimode` 10 versions, `jsontoken-extend` 14 versions, `df-vision` 12 versions, `cookie-ease` 10 versions, `router-kit` 30+ versions) - signals of long-running operator persistence that GHSA has now cleaned up in one shot.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN as of 2026-07-07 and should be treated as live malware in any lockfile hit - the CDN retention window for withdrawn npm versions typically runs 24–72 hours after the security replacement lands.

## Impact

- Any host that installed any of the ~155 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate "rotate all secrets from a different computer" language; no patched version exists for any of them
- The `polymarket-onchain-sdk@1.0.2`–`1.0.4` and `polymarket-onchain-plugin@2.1.3`–`2.1.5` names continue the crypto-wallet-drainer campaign already tracked under [polymarket-clob-math](https://dependencywatch.io/incident/npm-2026-06-27-polymarket-clob-math-vercel-loader) - same brand collision, different slugs, likely same operator
- The logger / pretty-print family (`pino-*`, `winston-*`, `chalk-*`, `picocolor-logger`, `chalki-pretty`, `prettier-logger`, `styled-text-logger`, `sleek-pretty`, `emojiprint-*`, `logger-beauty`, `color-cli-log`, `color-logger-console`, `awesome-cli-logger`, `elevate-log`, `custom-log-viewer`) squats the entire Node.js structured-logging naming space - 30+ distinct package names targeting the exact vocabulary a developer types when adding logging to a service
- The `bignumber.js` / crypto-math cluster (`bigint.os`, `bigint.fs`, `bn-eslint.js`, `bn-math`, `ether-bn.js`, `next-bignumber.js`, `big-numerator`, `big-numer`, `big-numerate`, `big256-ts`, `sjs-biginteger`, `mjs-biginteger`, `cjs-biginteger`, `bjs-biginteger`, `hjs-biginteger`, `st-biginteger`, `st-bigintr`) targets developers who typo the ubiquitous `bignumber.js` slug used across Ethereum/Solana tooling - many hit `5.0.5`+ versions to blend with `bignumber.js`'s own version range
- The tailwindcss / vite typosquat cluster (`tailwindcss-animatecss-latest`, `tailwindcss-fonttypo-inter`, `tailwindcss-fonttype-inter`, `tailwindcss-svg-helper`, `tailwindcss-framer-motion`, `tailwind-typography-plus`, `tailwind-fonttype-inter`, `tailwind-scroller`, `vite-plugin-svg-paths`, `vite-plugin-compress-js`, `vite-config-field`) continues the Tailwind/Animate.css / Vite plugin theme from the [2026-07-02 sweep](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep) - the same operator or a copycat is still working the same aesthetic naming space
- The chai `*-as-*` matcher cluster (`chai-guard`, `chai-dec`, `chai-as-init`, `chai-as-polished`, `chai-as-decrypted`) plausibly squats `chai-as-promised`, the canonical assertion adapter for async Chai tests - anyone adding an async matcher to a test suite between publish and 2026-07-06 could have grabbed one of these

## What to do

1. Grep your lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for every name in the packages map below - 155+ names is too many to eyeball. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. If you resolved `polymarket-onchain-sdk` or `polymarket-onchain-plugin` at any point: treat this as a crypto-wallet compromise. Any wallet key, seed phrase, or exchange API key that touched that machine should be rotated immediately and funds moved
3. Add the `pino-`, `winston-`, `chalk-`, `tailwindcss-`, `vite-plugin-`, `bignumber.js` / `big-*` / `bigint.*`, `eslint-`, `lint-`, and `chai-as-*` name prefixes to a review gate on any package addition - the malware operators have been farming these exact naming spaces for three consecutive months
4. Verify none of the 155+ listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
5. For the ESLint / TypeScript-lint family (`ts-lint-builds`, `ts-lint-builders`, `ts-eslinter`, `ts-eslint-helper`, `bjs-lint-*`, `hjs-lint-*`, `sjs-lint-*`, `es-lint-*`, `lint-builds`, `lint-builders`, `lint-null`, `lint-nule`, `lint-nuler`, `linter-entry`): none of these are legitimate ESLint or TypeScript packages. The canonical slugs are `eslint`, `@typescript-eslint/eslint-plugin`, `typescript-eslint`
6. If your build ever resolved a `*jsonupper` / `js-crypto-promise` / `js-unimode` / `jsontoken-extend` name: these are placeholder utility slugs common to malware operators; the mainstream JSON/JWT/promise-utility names (`json5`, `jsonwebtoken`, `p-map`, etc.) do not use these suffixes

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-89w2-qgj2-9f2w - polymarket-onchain-sdk malware advisory](https://github.com/advisories/GHSA-89w2-qgj2-9f2w) - GitHub
- [GHSA-29mh-pwqh-6586 - polymarket-onchain-plugin malware advisory](https://github.com/advisories/GHSA-29mh-pwqh-6586) - GitHub
- [GHSA-h89m-q7rj-4hxm - rollup-plugin-polyfill-handler malware advisory](https://github.com/advisories/GHSA-h89m-q7rj-4hxm) - GitHub
- [GHSA-99rj-fjph-w44m - react-next-dom malware advisory](https://github.com/advisories/GHSA-99rj-fjph-w44m) - GitHub
- [GHSA-3xpg-2wmm-jjj2 - winston-prism malware advisory](https://github.com/advisories/GHSA-3xpg-2wmm-jjj2) - GitHub
- [GHSA-fhrx-mrfp-3fvg - winston-js-express malware advisory](https://github.com/advisories/GHSA-fhrx-mrfp-3fvg) - GitHub
- [GHSA-jc9j-qfjm-7m7f - vite-plugin-compress-js malware advisory](https://github.com/advisories/GHSA-jc9j-qfjm-7m7f) - GitHub
- [GHSA-cjj7-4xf8-fgf8 - tailwindcss-animatecss-latest malware advisory](https://github.com/advisories/GHSA-cjj7-4xf8-fgf8) - GitHub
- [GHSA-9vrr-rpr8-7hfj - pretty-pino-logger malware advisory](https://github.com/advisories/GHSA-9vrr-rpr8-7hfj) - GitHub
- [GHSA-rg2r-h6hr-96rp - @jaime9008/math-service malware advisory](https://github.com/advisories/GHSA-rg2r-h6hr-96rp) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).