# GitHub Advisory npm malware sweep, 11 July 2026

> On 2026-07-10 (late-day) and 2026-07-11 GitHub's Advisory Database retired 11 CWE-506 npm malware advisories that arrived after the [earlier 2026-07-10 sweep](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep). Highlights: enterprise dependency-confusion continuation (`@higherlogic/ocfe`, `@att-ebiz/abs-components-bc`, `@amtrav/webservice`, `babel-eslint-parser-legacy` - all `99.9.1` race pins staged 2026-07-07 08:25–08:31 UTC), a `type-elint` / `type-plint` / `type-atob` micro-cluster (all `3.3.7`, published 2026-07-10 14:13–15:30 UTC), and an `authvaultx` + `auth-next-gen` auth-typosquat pair replaced 2026-07-11 00:06 UTC.

- Published: 2026-07-11
- Last updated: 2026-07-13
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 11 packages, 12 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft
- Also known as: 2026-07-11 GHSA npm sweep, Higher Logic AT&T eBiz dep-confusion burst
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-11-ghsa-malware-sweep

## Affected packages (11)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@amtrav/webservice](https://dependencywatch.io/package/npm/@amtrav/webservice) | npm | 99.9.1 |
| [@att-ebiz/abs-components-bc](https://dependencywatch.io/package/npm/@att-ebiz/abs-components-bc) | npm | 99.9.9 |
| [@higherlogic/ocfe](https://dependencywatch.io/package/npm/@higherlogic/ocfe) | npm | 99.9.1 |
| [auth-next-gen](https://dependencywatch.io/package/npm/auth-next-gen) | npm | 1.7.11 |
| [authvaultx](https://dependencywatch.io/package/npm/authvaultx) | npm | 1.0.0 |
| [babel-eslint-parser-legacy](https://dependencywatch.io/package/npm/babel-eslint-parser-legacy) | npm | 99.9.1 |
| [polipoli-pak](https://dependencywatch.io/package/npm/polipoli-pak) | npm | 1.0.1, 1.0.2 |
| [ryan-pdf-js](https://dependencywatch.io/package/npm/ryan-pdf-js) | npm | 1.0.0 |
| [type-atob](https://dependencywatch.io/package/npm/type-atob) | npm | 3.3.7 |
| [type-elint](https://dependencywatch.io/package/npm/type-elint) | npm | 3.3.7 |
| [type-plint](https://dependencywatch.io/package/npm/type-plint) | npm | 3.3.7 |

## What happened

Between 2026-07-10 (late-day) and 2026-07-11 GitHub's Advisory Database published 10 CWE-506 (Embedded Malicious Code) advisories against npm packages that arrived after the earlier 2026-07-10 morning sweep. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. No payload write-ups accompany the GHSA texts, so defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names.

## Cluster 1 - Enterprise dependency-confusion continuation (4 packages)

`@higherlogic/ocfe` (99.9.1, published 2026-07-07 08:25:09 UTC, replaced 2026-07-10 16:23:47 UTC), `@amtrav/webservice` (99.9.1, published 2026-07-07 08:26:53 UTC, replaced 2026-07-10 16:22:44 UTC - added on 2026-07-13 refresh after registry cross-check), `@att-ebiz/abs-components-bc` (all versions replaced 2026-07-10 16:23:10 UTC), `babel-eslint-parser-legacy` (99.9.1, published 2026-07-07 08:31:52 UTC, replaced 2026-07-10 16:19:19 UTC).

All four carry the `99.9.1` version pin - the canonical dependency-confusion race pin, chosen so any semver-based resolver returns the fake over any legitimate internal namesake regardless of the internal package's version. The four staging times (2026-07-07 08:25:09, 08:26:53, ~08:26, and 08:31:52 UTC) span only 7 minutes - the same operator, the same publish hour as the [2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager burst](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep), then held live for 3 full days before the take-down catch.

The target namespaces are named enterprise organizations:

- **`@higherlogic`** - Higher Logic is a B2B community-management and marketing-automation SaaS ([higherlogic.com](https://www.higherlogic.com)). The `ocfe` slug (Online Community Front End?) matches internal-naming shapes typical of enterprise CMS platforms.
- **`@amtrav`** - Amtrav is a corporate-travel-management platform ([amtrav.com](https://www.amtrav.com)). `@amtrav/webservice` matches internal-naming shapes typical of REST-service Node.js packages that a corporate-travel platform would build against.
- **`@att-ebiz`** - AT&T's Enterprise Business unit. Any AT&T enterprise dev group with an internal registry mirror and an `@att-ebiz/*` scope would have resolved the malicious public version if the mirror was misconfigured to fall through to the public registry.
- **`babel-eslint-parser-legacy`** - targets developers on legacy Babel + ESLint stacks. The canonical Babel ESLint packages are [`@babel/eslint-parser`](https://www.npmjs.com/package/@babel/eslint-parser) (current) and [`babel-eslint`](https://www.npmjs.com/package/babel-eslint) (deprecated). A "-legacy" companion is a plausible-sounding fake for anyone still maintaining a legacy config.

This is exactly the same operator playbook as the [2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager cluster](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep) and the [2026-06-29 internal-scope cluster](https://dependencywatch.io/incident/npm-2026-06-29-internal-scope-dep-confusion-cluster): enumerate a target org's public documentation, guess plausible internal package names, publish squats at a version high enough to win the resolver race.

## Cluster 2 - `type-*` 3.3.7 micro-cluster (3 packages)

`type-elint@3.3.7` (published 2026-07-10 14:13:44 UTC, replaced 20:37:18 UTC), `type-plint@3.3.7` (published 15:09:18 UTC, replaced 20:36:29 UTC), `type-atob@3.3.7` (published 15:30:29 UTC, replaced 20:33:21 UTC).

All three shipped exactly `3.3.7` in a 77-minute publish sprint by the same operator, then taken down together in a 4-minute take-down burst 5+ hours later. The exact-version convergence is the fingerprint of one operator working through a name list with a shared publish script that hard-codes the version tag.

- **`type-elint`** - visual typosquat of `type-eslint` (a plausible-but-non-existent "ESLint types" package). Anyone typing `type-eslint` and hitting a typo would land here.
- **`type-plint`** - visual variant of the same shape; may target `type-plus` (a real TypeScript utility library) or `type-lint` (plausible).
- **`type-atob`** - targets code that uses the `atob` / `btoa` base64 helpers and looks for a `@types/atob` variant. The canonical types-adjacent package for `atob` is `@types/atob` under the DefinitelyTyped scope; a free-standing `type-atob` has no legitimate parent.

## Cluster 3 - Auth-typosquat pair (2 packages)

`authvaultx` (all versions replaced 2026-07-11 00:06:59 UTC) and `auth-next-gen` (replaced 2026-07-11 00:06:54 UTC). Both replaced within a 5-second window on 2026-07-11 - same-actor coordinated take-down.

`auth-next-gen` is the more interesting of the two: it shipped a legitimate-looking `1.7.2` on 2026-07-02 (8 days of dormancy) before the malicious `1.7.11` bump on 2026-07-10 18:08:42 UTC. The `1.7.11` bump was live for ~6 hours before take-down. Any project pinning `^1.7.2` or `~1.7` would have resolved the malicious bump on the next `npm install`. This is a version-camouflage arc - publish a plausible clean release, wait a week, then publish the poisoned bump inside the same minor range so semver resolvers grab it silently.

`authvaultx` is a plausible-sounding "auth vault" typosquat with no legitimate namesake; all versions were replaced with the `0.0.1-security` holding tarball on take-down, so the original version numbers are no longer recoverable from the public registry.

## Cluster 4 - Residual typosquats (2 packages)

- **`polipoli-pak`** - 1.0.1 (2026-07-09 22:31:29 UTC) and 1.0.2 (22:34:51 UTC). Throwaway name with no obvious target - the shape reads as a language-play or transliteration slug. Notable: as of GHSA replacement, `polipoli-pak` still appears in the public registry as `1.0.2` (no `0.0.1-security` holding tarball yet), so any lockfile match will still install malware today.
- **`ryan-pdf-js`** - replaced 2026-07-10 16:20:33 UTC. Targets the PDF.js naming space (canonical: [`pdfjs-dist`](https://www.npmjs.com/package/pdfjs-dist)). Personal-name-prefixed throwaway; no legitimate parent.

## Contrast with recent sweeps

| Date | Packages | Notes |
|---|---|---|
| 2026-07-06 | ~155 | Largest 2026 sweep |
| 2026-07-07 | ~65 | AI-SDK typosquats + Solana base58 |
| 2026-07-08 | ~20 | Claude-Code typosquat cluster |
| 2026-07-10 (early) | 25 | Epic Games / LuminaryCloud / Voyager dep-confusion + nodemon family |
| **2026-07-10 (late) / 2026-07-11** | **11** | **Higher Logic / AT&T eBiz / Amtrav / babel-eslint dep-confusion + `type-*` 3.3.7 cluster + auth-typosquats** |

The running July 1–11 npm-malware retirement count is ~305 packages across 9 GHSA sweeps.

## Registry state

Every package except `polipoli-pak` now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN for 24–72 hours after the security replacement lands and should be treated as live malware in any lockfile hit - regardless of exact version. Because the security replacement wipes the historical version list from the public registry response for most packages, the version list below records the observed pre-replacement version numbers where the npm `time` map still reveals them, and the standard `99.9.9` dep-confusion race pin where the actual pre-replacement version is not recoverable.

## Impact

- Any host that installed any of the 10 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
- **Enterprise dependency-confusion continuation** (4 packages): `@higherlogic/ocfe`, `@att-ebiz/abs-components-bc`, and `@amtrav/webservice` extend the same dep-confusion campaign as the [2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager cluster](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep). All three scopes match real enterprise-organization namespaces - Higher Logic is a B2B community-management SaaS provider ([higherlogic.com](https://www.higherlogic.com)), `@att-ebiz` matches the AT&T Enterprise Business (eBiz) organizational naming, and `@amtrav` matches the Amtrav corporate-travel-management platform ([amtrav.com](https://www.amtrav.com)). `babel-eslint-parser-legacy` is a squat of the archived-but-still-referenced `babel-eslint` / `@babel/eslint-parser` ESLint plugin naming. All four shipped `99.9.1` - the classic dependency-confusion race pin (a version high enough to beat any legitimate internal namesake) - published 2026-07-07 08:25–08:31 UTC in a 6-minute window (same operator, same publish hour as the earlier [Epic Games burst](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep)) and taken down together on 2026-07-10 16:19–16:23 UTC
- **`type-*` 3.3.7 micro-cluster** (3 packages): `type-elint`, `type-plint`, `type-atob` - all shipped exactly `3.3.7` between 2026-07-10 14:13:44 and 15:30:29 UTC (77-minute publish sprint by the same operator). `type-elint` and `type-plint` are typosquats of `type-eslint` / `type-plus` naming space; `type-atob` targets any code that uses `atob` / `btoa` base64 helpers and looks for a `@types/atob` variant. The exact-version convergence on `3.3.7` is the signature of one operator working through a name list under a shared publish script
- **`authvaultx` + `auth-next-gen` auth-typosquat pair** (2 packages): both replaced with `0.0.1-security` on 2026-07-11 00:06:54 → 00:06:59 UTC - a 5-second replacement burst indicating same-actor coordinated take-down. `auth-next-gen` had a legitimate-looking version history (`1.7.2` on 2026-07-02, then a malicious `1.7.11` bump on 2026-07-10 18:08 UTC) - the poisoned bump was live for ~6 hours before takedown. `authvaultx` is a plausible-sounding auth-management-vault typosquat with no legitimate namesake
- **`polipoli-pak` + `ryan-pdf-js`** - 2 residual typosquats. `polipoli-pak` shipped `1.0.1`/`1.0.2` on 2026-07-09 22:31–22:34 UTC (throwaway name); `ryan-pdf-js` was replaced 2026-07-10 16:20 UTC and targets the PDF.js naming space (the canonical Mozilla library is `pdfjs-dist`)
- No payload write-up accompanies the GHSA texts - defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names. Combined with the [2026-07-10 sweep](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep) (25 packages), the running July 1–11 npm-malware retirement count is ~305 packages across 9 GHSA sweeps

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **If you work at Higher Logic or run community/CMS tooling under an `@higherlogic/*` scope**: audit every internal Node.js project for imports of `@higherlogic/ocfe`. This is a dep-confusion squat against your organizational scope. Register the `@higherlogic` scope on the public npm registry as a defensive stub, and route internal names via `.npmrc` scope pinning (`@higherlogic:registry=https://internal/`) so the public registry path is never queried
3. **If you work at AT&T or run tooling under `@att-ebiz` / `@att-*`**: `@att-ebiz/abs-components-bc` is a dep-confusion squat against the AT&T Enterprise Business naming space. Audit any internal build that could have resolved this. Register `@att-ebiz` (and any other AT&T-adjacent scope) as a defensive public stub
4. **If you work at Amtrav or use their corporate-travel tooling under `@amtrav/*`**: `@amtrav/webservice` is a dep-confusion squat against the Amtrav corporate-travel-management platform ([amtrav.com](https://www.amtrav.com)). Audit any internal Node.js project that could have resolved this. Register the `@amtrav` scope on the public npm registry as a defensive stub, and route internal names via `.npmrc` scope pinning so the public path is never queried
5. **If you had `babel-eslint-parser-legacy` in a lockfile**: the canonical packages are [`@babel/eslint-parser`](https://www.npmjs.com/package/@babel/eslint-parser) (current) or [`babel-eslint`](https://www.npmjs.com/package/babel-eslint) (deprecated but archived); there is no "-legacy" companion. The `99.9.1` version pin was designed to beat any legitimate internal fork resolution
6. For `type-elint`, `type-plint`, `type-atob` - none are legitimate first-party TypeScript type packages. The canonical `@types/*` scope is owned by the DefinitelyTyped project on npm; free-standing `type-*` package names of this shape have no first-party parent
7. For `authvaultx`, `auth-next-gen` - these are auth-management-tooling typosquats with no legitimate parent. `auth-next-gen` in particular ran a **version-camouflage arc**: a clean `1.7.2` on 2026-07-02 followed by a malicious `1.7.11` on 2026-07-10, so any project using `^1.7.2` or `~1.7` semver range would have resolved to the malicious bump on the next `npm install`. Pin exact versions or audit the resolved version in your lockfile
8. For `polipoli-pak` and `ryan-pdf-js` - these are throwaway typosquats with no legitimate parent. `ryan-pdf-js` targets the PDF.js naming space; the canonical Mozilla library is [`pdfjs-dist`](https://www.npmjs.com/package/pdfjs-dist). Any lockfile match should be treated as a compromise
9. Verify none of the 10 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-frr6-2jc6-6fhr - authvaultx malware advisory](https://github.com/advisories/GHSA-frr6-2jc6-6fhr) - GitHub
- [GHSA-8qpp-8j53-4wh7 - auth-next-gen malware advisory](https://github.com/advisories/GHSA-8qpp-8j53-4wh7) - GitHub
- [GHSA-v69h-23wr-hjg4 - type-elint malware advisory](https://github.com/advisories/GHSA-v69h-23wr-hjg4) - GitHub
- [GHSA-8mhh-r4mc-2293 - type-plint malware advisory](https://github.com/advisories/GHSA-8mhh-r4mc-2293) - GitHub
- [GHSA-w8g3-2xjv-6vf6 - type-atob malware advisory](https://github.com/advisories/GHSA-w8g3-2xjv-6vf6) - GitHub
- [GHSA-9rgw-9wxh-3pp2 - polipoli-pak malware advisory](https://github.com/advisories/GHSA-9rgw-9wxh-3pp2) - GitHub
- [GHSA-7qr7-hcw4-9826 - ryan-pdf-js malware advisory](https://github.com/advisories/GHSA-7qr7-hcw4-9826) - GitHub
- [GHSA-xr98-72p4-pwg2 - babel-eslint-parser-legacy malware advisory](https://github.com/advisories/GHSA-xr98-72p4-pwg2) - GitHub
- [GHSA-6mgp-q6qp-ffj2 - @att-ebiz/abs-components-bc malware advisory](https://github.com/advisories/GHSA-6mgp-q6qp-ffj2) - GitHub
- [GHSA-m2wg-xw25-9g9c - @higherlogic/ocfe malware advisory](https://github.com/advisories/GHSA-m2wg-xw25-9g9c) - GitHub
- [GHSA-frwh-6rv4-8cg3 - @amtrav/webservice malware advisory](https://github.com/advisories/GHSA-frwh-6rv4-8cg3) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).