# GitHub Advisory malware sweep - 20 npm packages (Claude-Code / Vue-CLI "clavue" typosquat cluster, `na-rony` throwaway sextet, tailwind-core, common-tg-service six-month sleeper) taken down 2026-07-08 / 2026-07-09

> On 2026-07-08 and 2026-07-09 GitHub's Advisory Database retired ~20 CWE-506 *Embedded Malicious Code* npm advisories, continuing the July take-down cadence at ~20 packages/day. Two distinct clusters: a **`clavue` / Claude-Code typosquat family** (`myclaude-code`, `clavue`, `clavuepro`, `calvuepro`, `clavue-agent-sdk`) targeting Anthropic AI CLI developers; and a **`na-rony*` throwaway sextet** - six packages published by one operator between 2026-07-08 03:22–03:39 UTC. Plus a `tailwind-core` typosquat carrying a real `4.3.x` version history and the six-month sleeper `common-tg-service` with 547 versions.

- Published: 2026-07-08
- Last updated: 2026-07-20
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 20 packages, 254 compromised versions
- Tags: typosquat, credential-theft, dependency-confusion
- Also known as: 2026-07-08 GHSA npm sweep, 2026-07-09 GHSA npm sweep
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-08-ghsa-malware-sweep

## Affected packages (20)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@calm2026/imux](https://dependencywatch.io/package/npm/@calm2026/imux) | npm | 1.9.1, 1.10.0, 1.10.2, 1.10.3, 1.10.4, 1.11.0 |
| [@vite-ln/build-ts](https://dependencywatch.io/package/npm/@vite-ln/build-ts) | npm | 5.15.10, 5.17.0 |
| [ams-ssk](https://dependencywatch.io/package/npm/ams-ssk) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, 1.0.31, 1.0.33 |
| [calvuepro](https://dependencywatch.io/package/npm/calvuepro) | npm | 0.1.0 |
| [clavue](https://dependencywatch.io/package/npm/clavue) | npm | 8.8.57, 8.9.0, 8.9.1, 8.9.2, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.1.0, 9.1.1, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.3.0, 9.4.0, 9.4.1, 9.4.2, 9.4.3, 9.4.4, 9.4.5, 9.4.6, 9.4.7, 9.4.8, 9.4.9, 9.4.10, 9.4.11, 9.5.0, 9.5.1, 9.5.2, 9.6.0, 9.6.1, 9.7.0, 9.7.1, 9.7.2, 9.7.3, 9.8.0, 9.8.1, 9.9.0, 9.10.0, 9.10.1, 9.10.2, 9.10.3, 9.10.4, 9.11.0, 9.11.1, 9.11.2, 9.11.3, 9.11.4, 9.11.5, 9.11.6, 9.11.7, 9.12.0, 9.13.0, 9.14.0, 9.14.1, 9.15.0, 9.16.0, 9.22.0, 9.26.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, 10.1.0, 10.1.1, 10.1.2, 10.1.3, 10.2.0, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.3.0, 10.3.1, 10.3.2, 10.4.0, 10.4.1, 10.4.2 |
| [clavue-agent-sdk](https://dependencywatch.io/package/npm/clavue-agent-sdk) | npm | 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.3.0, 0.3.1, 0.4.0, 0.5.0, 0.6.0, 0.6.1, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.8.0, 0.9.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 2.0.0, 2.2.0 |
| [clavuepro](https://dependencywatch.io/package/npm/clavuepro) | npm | 1.0.0 |
| [common-tg-service](https://dependencywatch.io/package/npm/common-tg-service) | npm | 1.0.101, 1.1.99, 1.2.100, 1.3.247 |
| [gas-log](https://dependencywatch.io/package/npm/gas-log) | npm | 1.1.0, 1.1.1 |
| [karem-dp](https://dependencywatch.io/package/npm/karem-dp) | npm | 99.9.9 |
| [mci-sdk](https://dependencywatch.io/package/npm/mci-sdk) | npm | 1.2.8, 1.2.9, 1.2.10, 1.2.11, 1.2.12, 1.2.13 |
| [myclaude-code](https://dependencywatch.io/package/npm/myclaude-code) | npm | 8.8.8, 8.8.9, 8.8.11, 8.8.12, 8.8.13, 8.8.14, 8.8.16, 8.8.17, 8.8.18, 8.8.19, 8.8.20, 8.8.21, 8.8.22, 8.8.23, 8.8.24, 8.8.25, 8.8.26, 8.8.27, 8.8.28, 8.8.30, 8.8.31, 8.8.32, 8.8.33, 8.8.34, 8.8.35, 8.8.37, 8.8.38, 8.8.39, 8.8.40, 8.8.41, 8.8.42, 8.8.43-beta.0, 8.8.43-beta.1, 8.8.43-beta.2, 8.8.43-beta.3, 8.8.43-beta.4, 8.8.43-beta.5, 8.8.43-beta.6, 8.8.43-beta.7, 8.8.43-beta.8, 8.8.43-beta.9, 8.8.43-beta.10, 8.8.43-beta.11, 8.8.44, 8.8.45, 8.8.46, 8.8.47, 8.8.48, 8.8.49, 8.8.50, 8.8.51, 8.8.52, 8.8.53, 8.8.54, 8.8.55, 8.8.56, 8.8.57 |
| [na-rony](https://dependencywatch.io/package/npm/na-rony) | npm | 1.1.2, 1.1.3, 1.1.4, 1.1.5, 99.9.9 |
| [na-rony-test](https://dependencywatch.io/package/npm/na-rony-test) | npm | 99.9.9 |
| [na-rony-test-karem](https://dependencywatch.io/package/npm/na-rony-test-karem) | npm | 1.0.0 |
| [nam-os-a-man](https://dependencywatch.io/package/npm/nam-os-a-man) | npm | 1.0.0 |
| [promo-helper](https://dependencywatch.io/package/npm/promo-helper) | npm | 1.0.0, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16 |
| [rony-testing](https://dependencywatch.io/package/npm/rony-testing) | npm | 99.9.9 |
| [tailwind-core](https://dependencywatch.io/package/npm/tailwind-core) | npm | 0.0.0, 4.3.0, 4.3.1, 4.3.2 |
| [vite-json-pwa](https://dependencywatch.io/package/npm/vite-json-pwa) | npm | 1.1.1, 1.1.2 |

## What happened

Between 2026-07-08 and 2026-07-09 GitHub's Advisory Database published ~20 CWE-506 (Embedded Malicious Code) advisories against npm packages. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-ups accompany the GHSA texts, so defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names. Combined with the [2026-07-07 sweep](https://dependencywatch.io/incident/npm-2026-07-07-ghsa-malware-sweep) (~65 packages) and the [2026-07-06 sweep](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep) (~155 packages), the running July 1–9 npm-malware retirement count is ~270 packages across 7 GHSA sweeps.

## Cluster 1 - Claude-Code / `clavue` typosquat family (campaign highlight, 5 packages)

`myclaude-code`, `clavue`, `clavuepro`, `calvuepro`, `clavue-agent-sdk`. Every one carries the same tell: a **legitimate-looking multi-week version history burst** followed by a final malicious publish. `myclaude-code` shipped 55 sequential versions (8.8.8 → 8.8.57 including 12 `8.8.43-beta.N` pre-releases) over multiple days - a persistent publish cadence that mimics an actively developed CLI. `clavue` carried 320+ versions spanning three months (April–July 2026) across dozens of minor-version branches (8.8.x, 8.9.x, up to 10.4.x) - the scale of a real long-lived library. `clavue-agent-sdk` released 29 versions from 0.2.2 up to 2.2.0 in a version-camouflage arc mimicking an SDK maturity path. `calvuepro` and `clavuepro` shipped short - `calvuepro` at `0.1.0`, `clavuepro` had all versions unpublished before GHSA retire.

The target namespace is Anthropic's Claude Code CLI. `myclaude-code` is a direct typosquat of the vendor's [`@anthropic-ai/claude-code`](https://www.npmjs.com/package/@anthropic-ai/claude-code). `clavue` and its variants are visual typos of "claude" that a hurried developer might mistype or a plausible auto-complete miss - the letters `l-a-v-u-e` rearrange to `l-a-u-d-e` minus one character. `clavue-agent-sdk` extends the visual-typo playbook into the Anthropic Agent SDK naming space. Anyone who searched npm for a Claude Code CLI helper in July 2026 could plausibly have landed on one of these fakes rather than the vendor package.

## Cluster 2 - `na-rony*` throwaway sextet (2026-07-08 03:22–03:39 UTC single-operator burst)

`na-rony`, `na-rony-test`, `na-rony-test-karem`, `nam-os-a-man`, `karem-dp`, `rony-testing`. All six published in a 17-minute window on 2026-07-08. Three landed straight on the dependency-confusion race version `99.9.9` (`karem-dp`, `na-rony-test`, `rony-testing`). Others had `1.1.x` histories (`na-rony@1.1.2`–`1.1.5`).

The shared name-tokens (`karem`, `rony`, `nam`) suggest a targeted attack against an internal package namespace that uses those name-tokens - the operator seeded every plausible variant they could think of. This is a canonical [Alex Birsan-style dependency-confusion attack](https://dependencywatch.io/incident/npm-2026-06-29-internal-scope-dep-confusion-cluster). The `99.9.9` pin is the giveaway: intentionally the highest possible version to win a semver resolver race against any legitimate internal package of the same name.

## Cluster 3 - Long-term sleeper: `common-tg-service` (547 versions, 16 months)

`common-tg-service` shipped **547 versions across 16 months** (2025-03-05 → 2026-07-08) in four release branches:

- `1.0.1` → `1.0.101` (101 releases, 2025-03-05 → 2025-06-12 - ~1 release/day)
- `1.1.1` → `1.1.99` (99 releases, 2025-06-12 → 2025-08-08)
- `1.2.1` → `1.2.100` (100 releases, 2025-08-08 → 2025-09-13)
- `1.3.1` → `1.3.247` (247 releases, 2025-09-13 → 2026-07-08 - ~10 months of steady drip)

No legitimate Telegram service library ships at that cadence. The scale and duration are the giveaway: this is a supply-chain-farming account seeded well ahead of use, letting the package accumulate a plausible "actively-maintained" appearance before the final malicious tag lands. Any dep-graph tooling that ranks packages by "activity" or "release frequency" would have rated `common-tg-service` highly.

## Cluster 4 - `tailwind-core` (version-history typosquat with `4.3.x` alignment)

`tailwind-core@0.0.0, 4.3.0, 4.3.1, 4.3.2`. The version numbers `4.3.0–4.3.2` are deliberately aligned to the real `tailwindcss` 4.3.x release train (2026-Q2), giving the fake plausible version-number legitimacy against anyone searching npm for "tailwind core". The canonical Tailwind slugs are `tailwindcss` (main) and `@tailwindcss/*` scoped official plugins - there is no first-party `tailwind-core` package.

### Update 2026-07-20 - Google-Apps-Script RCE + time-gated activation (tailwind-core payload)

The OpenSSF `malicious-packages` submission published on 2026-07-20 (OSSF PR [#1361](https://github.com/ossf/malicious-packages/pull/1361)) - covering versions `4.3.1` and `4.3.2` - attributes a fully-specified payload to the `tailwind-core` build path. When the exported runtime/build module is required, the package:

- Fingerprints the host (hostname, homedir, platform, architecture, CPU count, memory).
- Loads **embedded Google OAuth credentials** and authenticates to Google Apps Script + Google Sheets APIs.
- Fetches next-stage instructions from an attacker-controlled Apps Script deployment and executes returned code inline (arbitrary RCE via `eval`-style pattern).
- Writes host and environment disclosure back into an attacker-controlled Google Sheet.
- Is **time-gated: the payload only fires on or after 2026-07-10 UTC**, so hosts that resolved `tailwind-core@4.3.x` between the 2026-07-08 publish and 2026-07-10 activation window would not have observed outbound traffic to Google infrastructure. Any lockfile pin against `4.3.1` or `4.3.2` on a host that ran a build on or after 2026-07-10 should be treated as fully compromised.

The Google-Sheets / Apps-Script dead-drop C2 pattern is the same infrastructure family as the [ChocoPoC](https://dependencywatch.io/incident/pypi-2026-07-01-chocopoc-frint-skytext) Mapbox Dataset dead-drop technique (`api.mapbox.com` there, `script.google.com` + `sheets.googleapis.com` here): both abuse a trusted cloud service so egress domain-reputation filtering never fires. Endpoint EDR should treat `node` → `script.google.com` / `sheets.googleapis.com` calls on a build host as a strong `tailwind-core` indicator.

## Cluster 5 - Continuations from earlier July sweeps

- `promo-helper@1.0.0`–`1.0.16` - 16 sequential versions.
- `ams-ssk@1.0.0`–`1.0.33` (gap at `1.0.10`, `1.0.30`, `1.0.32`) - 32 versions.
- `mci-sdk@1.2.8`–`1.2.13` - 6 versions.
- `@vite-ln/build-ts@5.15.10, 5.17.0` - scoped throwaway (`@vite-ln`) targeting Vite naming space.
- `vite-json-pwa@1.1.1, 1.1.2` - Vite PWA plugin squat; canonical is `vite-plugin-pwa`.
- `gas-log@1.1.0, 1.1.1` - GAS (Google Apps Script) log helper squat.

## Cluster 6 - `@calm2026/imux` scoped throwaway

`@calm2026/imux@1.9.1`, `1.10.0`, `1.10.2`, `1.10.3`, `1.10.4`, `1.11.0`. Six versions of an "imux" package in a throwaway `@calm2026` scope. Scoped throwaway namespaces indicate an operator farming a specific naming space for one payload slot at a time - same pattern as the `@sqlite-list/*` / `@sqlite-access/*` continuations from the [2026-07-07 sweep](https://dependencywatch.io/incident/npm-2026-07-07-ghsa-malware-sweep).

## Contrast with recent sweeps

| Date | Packages | Notes |
|---|---|---|
| 2026-07-02 | 9 | Tailwind + `db-*` cluster |
| 2026-07-03 | 14 | TypeScript / API family + `@sql-*` scopes |
| 2026-07-06 | ~155 | Largest 2026 sweep |
| 2026-07-07 | ~65 | AI-SDK typosquats + Solana base58 |
| **2026-07-08 / 2026-07-09** | **~20** | **Claude-Code typosquat cluster + `na-rony` sextet + `common-tg-service` sleeper** |

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN for 24–72 hours after the security replacement lands and should be treated as live malware in any lockfile hit.

## Impact

- Any host that installed any of the ~20 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
- **Claude-Code / clavue typosquat cluster** - five names (`myclaude-code`, `clavue`, `clavuepro`, `calvuepro`, `clavue-agent-sdk`) targeting developers using Anthropic's Claude Code CLI. `clavue` shipped 320+ versions across three months (April–July 2026), presenting as a "clave"-style credential-manager library before landing the final poisoned publish. `clavue-agent-sdk` shipped 29 legitimate-looking versions from 0.2.2 up to 2.2.0 in a version-camouflage arc that mimics a real Agent SDK release history. `myclaude-code` published ~55 sequential versions (8.8.8–8.8.57 including 12 beta pre-releases) - a persistent multi-day publish burst designed to look like an active project. Anyone who typed `npm install claude-code`, `clavue`, or `clavue-agent-sdk` when they meant [`@anthropic-ai/claude-code`](https://www.npmjs.com/package/@anthropic-ai/claude-code) grabbed malware
- **`na-rony*` throwaway sextet** - six packages published in a 17-minute window on 2026-07-08 03:22–03:39 UTC by one operator: `na-rony`, `na-rony-test`, `na-rony-test-karem`, `nam-os-a-man`, `karem-dp`, `rony-testing`. Half went straight to the placeholder version `99.9.9` (the classic dependency-confusion race pin - a version so high it wins the resolver against any internal namesake). Others had `1.1.x` histories. Signature of a single operator seeding a naming space, likely for a targeted org - the shared `karem` / `rony` / `nam` tokens suggest human-name-based internal package targeting
- **`common-tg-service` - a 547-version six-month sleeper**. Published across four release branches (`1.0.x`, `1.1.x`, `1.2.x`, `1.3.x`) between 2025-03-05 and 2026-07-08 - 16 months of camouflage before the final malicious publish. The scale (547 versions, ~1.5/day sustained cadence) is the giveaway: no legitimate Telegram service library releases at that rate. Almost certainly a supply-chain-farming account seeded well ahead of use
- **`tailwind-core` typosquat** - carried versions `0.0.0`, `4.3.0`, `4.3.1`, `4.3.2`. The `4.3.x` range deliberately overlaps the real `tailwindcss` 4.3.x release train (2026-Q2), giving the fake plausible version-number legitimacy against anyone searching for "tailwind core". The canonical slugs are `tailwindcss` (main) and `@tailwindcss/*` (scoped official plugins) - there is no first-party `tailwind-core` package
- **Continuation packages from earlier July sweeps**: `promo-helper` (1.0.0–1.0.16), `ams-ssk` (1.0.0–1.0.33, no 1.0.10 or 1.0.30), `mci-sdk` (1.2.8–1.2.13), `@vite-ln/build-ts` (5.15.10, 5.17.0 - Vite naming space), `vite-json-pwa` (1.1.1, 1.1.2 - Vite PWA plugin squat), `gas-log` (1.1.0, 1.1.1)
- **`@calm2026` scoped throwaway** - `@calm2026/imux` shipped 6 versions (1.9.1 → 1.11.0) in the `imux` naming space; scoped throwaway namespaces (`@calm2026`) are a strong indicator that the operator was farming a specific naming space for one payload slot at a time
- Long-tail live-time slugs: `common-tg-service` was live for 16 months, `clavue` for 3 months, `clavue-agent-sdk` for weeks with 29 progressively-published versions. Anyone using a version-range resolver (`^1.0.0`, `latest`) that pulled the final poisoned tag would have installed malware on the first `npm install` after the retire date

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. If you resolved any of `myclaude-code`, `clavue`, `clavuepro`, `calvuepro`, or `clavue-agent-sdk`: these are not legitimate AI CLI packages. The canonical Anthropic slug is [`@anthropic-ai/claude-code`](https://www.npmjs.com/package/@anthropic-ai/claude-code) - no other Claude-adjacent name should resolve on npm. Rotate every Anthropic API key, GitHub PAT, and shell-history-visible secret that touched the affected host
3. If your build resolved any `na-rony*`, `nam-os-a-man`, `karem-dp`, or `rony-testing` name: these are targeted dependency-confusion attempts (three of the six landed on `99.9.9`). Any internal package with a similar name at your org should be treated as a potential leak of the internal naming - audit private-registry logs for who was resolving that name and when. Rotate CI/CD secrets on any host that ran an affected install
4. If your build resolved `tailwind-core@4.3.x`: the canonical Tailwind package is `tailwindcss` (the main framework) or `@tailwindcss/*` for official plugins. The `4.3.x` version alignment was chosen to look plausible against the real Tailwind 4.3 release train - check any CSS-tooling dependency added recently against the official Tailwind registry entry
5. If your build resolved `common-tg-service`: the six-month version history was camouflage. Assume malware was live from the final poisoned tag onward - check the exact resolved version in your lockfile against the retired advisory. Any Telegram bot / channel token that was reachable from the build host should be rotated
6. `@vite-ln/build-ts` and `vite-json-pwa` are typosquats of the Vite / Vite PWA ecosystem. The canonical Vite scope is `vite` and `@vitejs/*`; PWA plugin is `vite-plugin-pwa`. Any recent Vite plugin addition should be cross-checked against these official slugs
7. Verify none of the ~20 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-f5r3-gf4p-pf67 - myclaude-code malware advisory](https://github.com/advisories/GHSA-f5r3-gf4p-pf67) - GitHub
- [GHSA-3qpf-99hh-7hp4 - clavue malware advisory](https://github.com/advisories/GHSA-3qpf-99hh-7hp4) - GitHub
- [GHSA-7m5m-ch5w-5q7v - clavuepro malware advisory](https://github.com/advisories/GHSA-7m5m-ch5w-5q7v) - GitHub
- [GHSA-82qq-fgw6-6hf8 - calvuepro malware advisory](https://github.com/advisories/GHSA-82qq-fgw6-6hf8) - GitHub
- [GHSA-vxh6-2g6j-qrrc - clavue-agent-sdk malware advisory](https://github.com/advisories/GHSA-vxh6-2g6j-qrrc) - GitHub
- [GHSA-vwgj-9938-7p8q - @calm2026/imux malware advisory](https://github.com/advisories/GHSA-vwgj-9938-7p8q) - GitHub
- [GHSA-m6r5-49q4-pv25 - tailwind-core malware advisory](https://github.com/advisories/GHSA-m6r5-49q4-pv25) - GitHub
- [OpenSSF malicious-packages #1361 - tailwind-core payload disclosure (Google Apps Script RCE, time-gated)](https://github.com/ossf/malicious-packages/pull/1361) - OpenSSF
- [GHSA-wvhv-cgwm-v2hv - common-tg-service malware advisory](https://github.com/advisories/GHSA-wvhv-cgwm-v2hv) - GitHub
- [GHSA-mvg5-c69w-jg7r - promo-helper malware advisory](https://github.com/advisories/GHSA-mvg5-c69w-jg7r) - GitHub
- [GHSA-827p-whjw-xp3w - ams-ssk malware advisory](https://github.com/advisories/GHSA-827p-whjw-xp3w) - GitHub
- [GHSA-p85w-qq28-35h6 - @vite-ln/build-ts malware advisory](https://github.com/advisories/GHSA-p85w-qq28-35h6) - GitHub
- [GHSA-7cjh-m5vf-hp3r - mci-sdk malware advisory](https://github.com/advisories/GHSA-7cjh-m5vf-hp3r) - GitHub
- [GHSA-7p38-gfgq-g3f3 - rony-testing malware advisory](https://github.com/advisories/GHSA-7p38-gfgq-g3f3) - GitHub
- [GHSA-pfc9-hmhj-8x4p - na-rony-test-karem malware advisory](https://github.com/advisories/GHSA-pfc9-hmhj-8x4p) - GitHub
- [GHSA-ppr7-xf9p-cqpg - na-rony-test malware advisory](https://github.com/advisories/GHSA-ppr7-xf9p-cqpg) - GitHub
- [GHSA-qq66-gj73-6pqm - nam-os-a-man malware advisory](https://github.com/advisories/GHSA-qq66-gj73-6pqm) - GitHub
- [GHSA-f83g-5hxf-2g39 - na-rony malware advisory](https://github.com/advisories/GHSA-f83g-5hxf-2g39) - GitHub
- [GHSA-qfm3-6pmh-jr8j - karem-dp malware advisory](https://github.com/advisories/GHSA-qfm3-6pmh-jr8j) - GitHub
- [GHSA-3f72-wf55-pqjc - vite-json-pwa malware advisory](https://github.com/advisories/GHSA-3f72-wf55-pqjc) - GitHub
- [GHSA-24x9-3433-gqp9 - gas-log malware advisory](https://github.com/advisories/GHSA-24x9-3433-gqp9) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-08-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-08-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).