# GitHub Advisory malware sweep - ~65 npm packages (AI-SDK typosquat cluster, Solana base58/wallet drainers, SQLite scoped fakes, Nuxt/Chai continuation) taken down 2026-07-07 / 2026-07-08

> On 2026-07-07 GitHub's Advisory Database retired ~65 CWE-506 *Embedded Malicious Code* npm advisories (plus a small 2-package 2026-07-08 tail), the second-largest single-day 2026 GHSA npm-malware sweep after 2026-07-06. Distinct clusters: an AI-SDK typosquat family (`openai-agents-helpers`, `ollama-helpers`, `anthropic-toolkit`, `@langgraphjs/toolkit`, `ai-sdk-helpers`, `mcp-server-pg`), Solana `base58` wallet-drainer names, `@sqlite-list/*` / `@sqlite-access/*` throwaway scopes, Nuxt/Chai continuations, plus the `whs4_*` sextet.

- Published: 2026-07-07
- Last updated: 2026-07-08
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 62 packages, 212 compromised versions
- Tags: typosquat, credential-theft, crypto-wallet-drain, dependency-confusion
- Also known as: 2026-07-07 GHSA npm sweep, 2026-07-08 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-07-ghsa-malware-sweep

## Affected packages (62)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@43uh3ig43/telemetry-client](https://dependencywatch.io/package/npm/@43uh3ig43/telemetry-client) | npm | 99.0.1 |
| [@apexcraft/nano-key](https://dependencywatch.io/package/npm/@apexcraft/nano-key) | npm | 1.2.4, 1.2.5, 1.3.2, 1.3.3 |
| [@aspect-security/argon2](https://dependencywatch.io/package/npm/@aspect-security/argon2) | npm | 1.0.0, 1.0.1 |
| [@engagehub/core](https://dependencywatch.io/package/npm/@engagehub/core) | npm | 99.0.0 |
| [@engagehub/test-claim](https://dependencywatch.io/package/npm/@engagehub/test-claim) | npm | 1.0.0 |
| [@langgraphjs/toolkit](https://dependencywatch.io/package/npm/@langgraphjs/toolkit) | npm | 1.2.13 |
| [@sqlite-access/nodesql](https://dependencywatch.io/package/npm/@sqlite-access/nodesql) | npm | 1.0.2 |
| [@sqlite-list/createsql](https://dependencywatch.io/package/npm/@sqlite-list/createsql) | npm | 1.0.0 |
| [@sqlite-list/schema-generator](https://dependencywatch.io/package/npm/@sqlite-list/schema-generator) | npm | 1.0.2 |
| [@sqlite-list/sql-creator](https://dependencywatch.io/package/npm/@sqlite-list/sql-creator) | npm | 1.0.6, 1.0.7 |
| [ai-sdk-helpers](https://dependencywatch.io/package/npm/ai-sdk-helpers) | npm | 1.4.5 |
| [annotator-harvardx](https://dependencywatch.io/package/npm/annotator-harvardx) | npm | 9.0.2 |
| [anthropic-toolkit](https://dependencywatch.io/package/npm/anthropic-toolkit) | npm | 1.3.1 |
| [base58-cli](https://dependencywatch.io/package/npm/base58-cli) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
| [base58-core](https://dependencywatch.io/package/npm/base58-core) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.10, 1.0.11, 1.0.12 |
| [brunomenozzi-test-pkg](https://dependencywatch.io/package/npm/brunomenozzi-test-pkg) | npm | 1.0.0 |
| [chai-chain-dom](https://dependencywatch.io/package/npm/chai-chain-dom) | npm | 1.3.7, 1.3.8, 1.3.9 |
| [chai-sdk](https://dependencywatch.io/package/npm/chai-sdk) | npm | 1.4.7, 1.4.8 |
| [chai-spycore](https://dependencywatch.io/package/npm/chai-spycore) | npm | 1.1.0, 1.5.3 |
| [crypto-base58](https://dependencywatch.io/package/npm/crypto-base58) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [debugcli](https://dependencywatch.io/package/npm/debugcli) | npm | 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.4.1 |
| [evm-typechain](https://dependencywatch.io/package/npm/evm-typechain) | npm | 0.5.4 |
| [express-deflect](https://dependencywatch.io/package/npm/express-deflect) | npm | 1.3.1, 1.6.9, 1.6.10, 1.6.12 |
| [express-firegate](https://dependencywatch.io/package/npm/express-firegate) | npm | 1.3.5, 1.4.0, 1.4.5, 1.4.6, 1.5.1, 1.5.5, 1.6.1, 1.6.3, 1.6.5, 1.6.7, 1.6.8, 1.6.9 |
| [gen-ai-opt-in](https://dependencywatch.io/package/npm/gen-ai-opt-in) | npm | 99.0.0, 99.0.1, 99.0.2 |
| [harmony-enablers-test-2026](https://dependencywatch.io/package/npm/harmony-enablers-test-2026) | npm | 1.0.0 |
| [hello244a](https://dependencywatch.io/package/npm/hello244a) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, 1.0.30, 1.0.31, 1.0.32, 1.0.33, 1.0.34, 1.0.35, 1.0.36, 1.0.37, 1.0.38, 1.0.39, 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45 |
| [hook-augmenting-module](https://dependencywatch.io/package/npm/hook-augmenting-module) | npm | 99.0.3 |
| [jsf-utils](https://dependencywatch.io/package/npm/jsf-utils) | npm | 0.3.1, 1.3.1 |
| [load-nuxt](https://dependencywatch.io/package/npm/load-nuxt) | npm | 99.0.3 |
| [load-nuxt-dev](https://dependencywatch.io/package/npm/load-nuxt-dev) | npm | 99.0.3 |
| [mcp-server-pg](https://dependencywatch.io/package/npm/mcp-server-pg) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.8.0, 0.9.0, 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.2.2 |
| [nodemon-node](https://dependencywatch.io/package/npm/nodemon-node) | npm | 3.1.16 |
| [nonexistent-package](https://dependencywatch.io/package/npm/nonexistent-package) | npm | 99.0.3 |
| [notifier-utils](https://dependencywatch.io/package/npm/notifier-utils) | npm | 1.3.7, 1.3.8, 1.3.9, 1.4.0 |
| [nuxt-fonts-devtools](https://dependencywatch.io/package/npm/nuxt-fonts-devtools) | npm | 99.0.3 |
| [ollama-helpers](https://dependencywatch.io/package/npm/ollama-helpers) | npm | 1.2.3 |
| [openai-agents-helpers](https://dependencywatch.io/package/npm/openai-agents-helpers) | npm | 1.3.3 |
| [pinokio-redis](https://dependencywatch.io/package/npm/pinokio-redis) | npm | 1.0.127 |
| [polytrade](https://dependencywatch.io/package/npm/polytrade) | npm | 2.4.1 |
| [rnx-align-deps](https://dependencywatch.io/package/npm/rnx-align-deps) | npm | 99.0.7 |
| [runtimedev-link](https://dependencywatch.io/package/npm/runtimedev-link) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14 |
| [shopify-internel](https://dependencywatch.io/package/npm/shopify-internel) | npm | 99.0.1 |
| [solana-address-codec](https://dependencywatch.io/package/npm/solana-address-codec) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
| [some-theme](https://dependencywatch.io/package/npm/some-theme) | npm | 99.0.3 |
| [syco1](https://dependencywatch.io/package/npm/syco1) | npm | 1.0.3, 1.0.4, 1.0.5 |
| [sypoi1](https://dependencywatch.io/package/npm/sypoi1) | npm | 1.0.0, 1.0.1, 1.0.2 |
| [tailwind-animator-scroll](https://dependencywatch.io/package/npm/tailwind-animator-scroll) | npm | 1.7.0 |
| [tailwindcss-effector](https://dependencywatch.io/package/npm/tailwindcss-effector) | npm | 1.7.0 |
| [ts-await](https://dependencywatch.io/package/npm/ts-await) | npm | 3.1.8 |
| [tx-guard-snap](https://dependencywatch.io/package/npm/tx-guard-snap) | npm | 1.0.0 |
| [typescript-base58](https://dependencywatch.io/package/npm/typescript-base58) | npm | 1.0.0 |
| [warp-dependency](https://dependencywatch.io/package/npm/warp-dependency) | npm | 1.0.0, 1.0.1 |
| [whs4_nmp](https://dependencywatch.io/package/npm/whs4_nmp) | npm | 1.0.0, 1.0.1 |
| [whs4_npm](https://dependencywatch.io/package/npm/whs4_npm) | npm | 1.0.0 |
| [whs4_npm_test](https://dependencywatch.io/package/npm/whs4_npm_test) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [whs4_pnm](https://dependencywatch.io/package/npm/whs4_pnm) | npm | 1.0.0 |
| [wsh4_npm](https://dependencywatch.io/package/npm/wsh4_npm) | npm | 1.0.0 |
| [wsh4-nmp](https://dependencywatch.io/package/npm/wsh4-nmp) | npm | 1.0.0 |
| [zod-pino434](https://dependencywatch.io/package/npm/zod-pino434) | npm | 1.0.127, 1.0.128 |
| [zod-pino444](https://dependencywatch.io/package/npm/zod-pino444) | npm | 1.0.128, 1.0.129, 1.0.130, 1.0.131 |
| [zredis-typed](https://dependencywatch.io/package/npm/zredis-typed) | npm | 1.0.127 |

## What happened

Between 2026-07-07 and 2026-07-08 GitHub's Advisory Database published ~65 CWE-506 (Embedded Malicious Code) advisories against npm packages, running to about the same size as the [2026-07-06 sweep](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep). Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-ups accompany the GHSA texts, so defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names.

## Cluster 1 - AI SDK typosquats (6 packages, campaign highlight)

`openai-agents-helpers`, `ollama-helpers`, `anthropic-toolkit`, `@langgraphjs/toolkit`, `ai-sdk-helpers`, `mcp-server-pg`. All six carry the exact same tell: a **version-camouflage history burst** (20+ throwaway versions rapidly published over a few minutes in June to look like a mature library) followed by a fresh malicious `1.x.x` publish at **2026-07-07 13:22 UTC** - every one in the same 3-minute window. Example: `ai-sdk-helpers` published 22 versions on 2026-06-03 20:31 UTC (all 4-second intervals - a bulk-publish script), then bumped `1.4.4` → `1.4.5` on 2026-07-07 13:22:25. The pattern targets `latest`-tag pulls and `^`-range resolvers: any repo pinned to the previous version tag would upgrade to the poisoned tag on the next `npm install`. The legitimate SDK slugs those names impersonate: `openai` (OpenAI SDK), `ollama`, `@anthropic-ai/sdk`, `@langchain/langgraph`, `ai` (Vercel AI SDK), `@modelcontextprotocol/server-postgres`.

## Cluster 2 - Solana base58 wallet-drainer (5 packages)

`base58-core@1.0.0`–`1.0.12` (12 versions, 2026-06-24 → 2026-07-05), `base58-cli@1.0.0`–`1.0.5`, `crypto-base58@1.0.0`–`1.0.4`, `typescript-base58@1.0.0`, `solana-address-codec@1.0.0`–`1.0.5`. All hit `1.0.x` version ranges typical of a fresh crypto-helper package. Six weeks of live time on the "helper for Solana address encoding" naming space - anyone who searched npm for `base58` and picked a helper-flavored slug (rather than the canonical `bs58`) is at risk. `solana-address-codec` in particular is a plausible drop-in for developers used to the Solana Kit ecosystem's `@solana/addresses` scoped package.

## Cluster 3 - `@sqlite-list/*` / `@sqlite-access/*` scoped throwaways (4 packages)

`@sqlite-list/schema-generator`, `@sqlite-list/createsql`, `@sqlite-list/sql-creator`, `@sqlite-access/nodesql`. Direct continuation of the [2026-07-03 GHSA sweep](https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep)'s `@sql-access/nodesql` / `@sqlite-node/createsql` / `@sql-trigger/nodesql` cluster - same throwaway-scope model where each namespace holds exactly one malware slot. All four published between 2026-07-03 19:04 UTC and 19:40 UTC - one 36-minute burst. The operator behind the July 3 SQL-scoped cluster is still active.

## Cluster 4 - Nuxt / dependency-confusion (7 packages, `99.0.x`)

`nuxt-fonts-devtools@99.0.3`, `load-nuxt@99.0.3`, `load-nuxt-dev@99.0.3`, `some-theme@99.0.3`, `nonexistent-package@99.0.3`, `hook-augmenting-module@99.0.3` (all 2026-07-03 04:33–04:44 UTC - 11-minute burst) and `gen-ai-opt-in@99.0.0`–`99.0.2` (2026-07-05). The shared `99.0.x` version-number is the giveaway: an intentionally-high version to win a dependency-confusion race against an internal package of the same name. This is a canonical [Alex Birsan-style dependency-confusion attack](https://dependencywatch.io/incident/npm-2026-06-29-internal-scope-dep-confusion-cluster) - one operator, one build script, six near-simultaneous publishes targeting names that plausibly appear in a private Nuxt/Vue registry namespace at a target org.

## Cluster 5 - Chai / Express / Tailwind continuations

- Chai: `chai-sdk@1.4.7`/`1.4.8`, `chai-spycore@1.1.0`/`1.5.3`, `chai-chain-dom@1.3.7`–`1.3.9`. Continues the `chai-as-*` matcher-squat cluster from [2026-07-06](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep).
- Express: `express-firegate@1.3.5`–`1.6.9` (12 versions running back to 2026-05-12), `express-deflect@1.3.1`–`1.6.12` (running back to 2026-05-12, then a 2026-07-06 top-up publish at 1.6.10/1.6.12). Fake middleware slugs - the legitimate Express security middleware ecosystem is `helmet`, `express-rate-limit`, `csurf`.
- Tailwind: `tailwind-animator-scroll@1.7.0` (2026-06-11), `tailwindcss-effector@1.7.0` (2026-06-22). Continues the Tailwind theme from [2026-07-02](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep).

## Cluster 6 - `whs4_*` sextet (single-operator burst, 2026-07-05)

`@whs4/whs4_npm`, `whs4_npm`, `whs4_pnm`, `whs4_nmp`, `wsh4-nmp`, `wsh4_npm`, `whs4_npm_test`. All published between 15:03 and 15:38 UTC on 2026-07-05 - 35 minutes for one operator to grab every near-miss variant of the target slug (`whs4_npm`). This is either a CTF/testing account or a naming-space grab attempt. Whatever the intent, GHSA classified every one as CWE-506 embedded malicious code.

## Cluster 7 - Miscellaneous (~30 packages)

The remainder is the usual long tail of individual typosquats and throwaway names: `evm-typechain@0.5.4` (Ethereum tooling squat - the canonical slug is `typechain`), `polytrade@2.4.1` (Polymarket-adjacent), `hello244a` (45 versions of a single-file publish burst), `nodemon-node@3.1.16` and `ts-await@3.1.8` (published 2026-07-07 19:49/19:51 UTC, both retired 2026-07-08 - a 24-hour turnaround GHSA sweep), `runtimedev-link` (13 versions), `zredis-typed`, `zod-pino434`/`zod-pino444`, `pinokio-redis` (Pino/Redis/Zod naming space), `warp-dependency`, `sypoi1`, `syco1`, `polytrade`, `debugcli`, `tx-guard-snap`, `jsf-utils`, `notifier-utils`, `hello244a`, `rnx-align-deps`, `annotator-harvardx`, `shopify-internel` (typosquat of `@shopify/*`), `harmony-enablers-test-2026`, `@43uh3ig43/telemetry-client`, `brunomenozzi-test-pkg`, `@apexcraft/nano-key`, `@engagehub/test-claim`, `@engagehub/core`, `@aspect-security/argon2` (argon2 typosquat - dangerous given argon2 is a password-hashing lib).

## Contrast with recent sweeps

| Date | Packages | Notes |
|---|---|---|
| 2026-06-30 | 5 | Small sweep |
| 2026-07-02 | 9 | Tailwind + `db-*` cluster |
| 2026-07-03 | 14 | TypeScript/API family + `@sql-*` scopes |
| 2026-07-06 | ~155 | Largest 2026 sweep |
| **2026-07-07** | **~65** | **AI-SDK typosquats + Solana base58 + `@sqlite-*` continuation** |

Combined July 1–8 npm-malware retirement count: ~250 packages across 6 GHSA sweeps - a step-change in the platform's take-down cadence.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN as of 2026-07-08 and should be treated as live malware in any lockfile hit - the CDN retention window for withdrawn npm versions typically runs 24–72 hours after the security replacement lands.

## Impact

- Any host that installed any of the ~65 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
- The AI-SDK typosquat cluster (`openai-agents-helpers`, `ollama-helpers`, `anthropic-toolkit`, `@langgraphjs/toolkit`, `ai-sdk-helpers`, `mcp-server-pg`) targets developers pasting AI SDK setup snippets. All six landed on their **latest tag** with a fresh `1.x.x` publish at 2026-07-07 13:22 UTC - same 3-minute window, five of the six had accumulated 20+ prior versions in a version-history-camouflage burst on 2026-06-23 to 2026-06-29 to look legitimate before the malicious tag landed
- The Solana base58 wallet-drainer cluster (`base58-core`, `base58-cli`, `crypto-base58`, `typescript-base58`, `solana-address-codec`) has 30+ combined versions dating back to 2026-06-24 - six weeks of live time on a "helper for Solana address encoding" naming space. If anyone on a build host also holds a Solana wallet key, the exposure window is up to six weeks
- The `@sqlite-list/*` (schema-generator, createsql, sql-creator) and `@sqlite-access/nodesql` cluster continues the [2026-07-03 GHSA sweep](https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep)'s `@sql-access/nodesql` / `@sqlite-node/createsql` pattern - same throwaway-scope model, same "one malware slot per personal namespace" operator behavior, still active four days after the last take-down
- The `whs4_*` cluster (7 near-identical typosquats - `whs4_npm`, `whs4_pnm`, `whs4_nmp`, `wsh4-nmp`, `wsh4_npm`, `whs4_npm_test`, `@whs4/whs4_npm`) all published in a 30-minute window on 2026-07-05 15:03–15:38 UTC. Signature of a single operator or CTF/testing account grabbing every near-miss slug before publishing the final target
- Continuation packages from earlier July sweeps: `chai-spycore`, `chai-sdk`, `chai-chain-dom` (Chai matcher squats, extending the [2026-07-06 chai-as-* cluster](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep)); `tailwind-animator-scroll`, `tailwindcss-effector` (Tailwind theme, extending [2026-07-02](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep) / [2026-07-06](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep)); `express-firegate`, `express-deflect` (Express middleware fakes, running since 2026-05-12)
- The Nuxt cluster (`nuxt-fonts-devtools`, `load-nuxt`, `load-nuxt-dev`, `some-theme`, `nonexistent-package`, `hook-augmenting-module`, `gen-ai-opt-in`) all shipped identical `99.0.x` version numbers - the `99.0.3` collision across five names indicates one publisher, one build script, and a plausible dependency-confusion attempt targeting an internal Nuxt module namespace
- Very-long-tail live-time slugs: `openai-agents-helpers` / `ollama-helpers` (22+ prior burst versions), `anthropic-toolkit` (20+ burst versions), `ai-sdk-helpers` (24+ burst versions), `@apexcraft/nano-key` (4 versions across 10 days in June). Anyone using a version-range resolver (`^1.0.0`, `latest`) that pulled the final poisoned tag would have installed malware on the first `npm install` after 2026-07-07 13:22 UTC

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below - ~65 names is too many to eyeball. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. If you resolved any of `openai-agents-helpers`, `ollama-helpers`, `anthropic-toolkit`, `@langgraphjs/toolkit`, `ai-sdk-helpers`, or `mcp-server-pg`: these are not legitimate SDKs. The canonical AI-SDK slugs are `openai`, `ollama`, `@anthropic-ai/sdk`, `@langchain/langgraph`, `ai` (Vercel), and `@modelcontextprotocol/*` scoped packages. Anyone who typed a plausible-sounding "helper" or "toolkit" variant grabbed malware - rotate every AI provider API key that touched the affected host
3. If your build ever resolved a `base58-*`, `crypto-base58`, `typescript-base58`, or `solana-address-codec` name: treat as a Solana wallet compromise. Any wallet key, seed phrase, or exchange API key on the machine should be moved. The legitimate slugs are `bs58` and `@solana/web3.js`
4. If your build resolved any `@sqlite-list/*` or `@sqlite-access/*` name: the mainstream slugs are `better-sqlite3`, `sqlite3`, or `@libsql/*`. There is no legitimate `@sqlite-list` or `@sqlite-access` publisher scope on npm
5. For the Nuxt cluster (`nuxt-fonts-devtools`, `load-nuxt`, `load-nuxt-dev`, `some-theme`, `nonexistent-package`, `hook-augmenting-module`, `gen-ai-opt-in`) - the tell is the shared `99.0.3` version pin. If you see any dep resolve to `99.0.x` on an unfamiliar Nuxt-adjacent package, treat as dependency-confusion malware and check whether any internal package of the same name should have won the resolution
6. Verify none of the ~65 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
7. Add the `@sqlite-list`, `@sqlite-access`, `@engagehub`, `@43uh3ig43`, and the AI-SDK "helpers/toolkit/kit" suffix pattern to a review gate on any package addition - the malware operators have been farming these exact naming spaces across three consecutive weeks

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-3mxc-g5f6-qr8c - openai-agents-helpers malware advisory](https://github.com/advisories/GHSA-3mxc-g5f6-qr8c) - GitHub
- [GHSA-73pg-hv45-6r54 - ollama-helpers malware advisory](https://github.com/advisories/GHSA-73pg-hv45-6r54) - GitHub
- [GHSA-c7v6-f7mc-9crv - anthropic-toolkit malware advisory](https://github.com/advisories/GHSA-c7v6-f7mc-9crv) - GitHub
- [GHSA-pq32-2vxj-cr62 - @langgraphjs/toolkit malware advisory](https://github.com/advisories/GHSA-pq32-2vxj-cr62) - GitHub
- [GHSA-w43g-ccrm-v8xv - ai-sdk-helpers malware advisory](https://github.com/advisories/GHSA-w43g-ccrm-v8xv) - GitHub
- [GHSA-cfv7-74pc-vmff - mcp-server-pg malware advisory](https://github.com/advisories/GHSA-cfv7-74pc-vmff) - GitHub
- [GHSA-9jx5-jcp6-qmqq - solana-address-codec malware advisory](https://github.com/advisories/GHSA-9jx5-jcp6-qmqq) - GitHub
- [GHSA-3439-q8cv-mg5v - base58-core malware advisory](https://github.com/advisories/GHSA-3439-q8cv-mg5v) - GitHub
- [GHSA-frf3-wxv2-p559 - crypto-base58 malware advisory](https://github.com/advisories/GHSA-frf3-wxv2-p559) - GitHub
- [GHSA-2859-847v-c4v9 - @sqlite-list/schema-generator malware advisory](https://github.com/advisories/GHSA-2859-847v-c4v9) - GitHub
- [GHSA-www8-7fg3-xg79 - @sqlite-list/createsql malware advisory](https://github.com/advisories/GHSA-www8-7fg3-xg79) - GitHub
- [GHSA-m2mh-6v6x-qh4f - @sqlite-access/nodesql malware advisory](https://github.com/advisories/GHSA-m2mh-6v6x-qh4f) - GitHub
- [GHSA-hw4h-mjrw-4qv9 - nuxt-fonts-devtools malware advisory](https://github.com/advisories/GHSA-hw4h-mjrw-4qv9) - GitHub
- [GHSA-qqp7-wmv2-mp34 - load-nuxt malware advisory](https://github.com/advisories/GHSA-qqp7-wmv2-mp34) - GitHub
- [GHSA-58j3-rgh4-9rjc - nodemon-node malware advisory](https://github.com/advisories/GHSA-58j3-rgh4-9rjc) - GitHub
- [GHSA-xpmf-x27p-9vcc - ts-await malware advisory](https://github.com/advisories/GHSA-xpmf-x27p-9vcc) - GitHub
- [GHSA-3wm9-8rfp-wp25 - whs4_npm malware advisory](https://github.com/advisories/GHSA-3wm9-8rfp-wp25) - GitHub
- [GHSA-4fc4-v9cp-846x - @aspect-security/argon2 malware advisory](https://github.com/advisories/GHSA-4fc4-v9cp-846x) - GitHub
- [GHSA-r7mv-rcm7-x7m3 - polytrade malware advisory](https://github.com/advisories/GHSA-r7mv-rcm7-x7m3) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-07-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-07-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).