# GitHub Advisory npm malware sweep, 15 July 2026

> On 2026-07-15 GitHub's Advisory Database retired 25 CWE-506 npm malware advisories in four clean bursts. Highlights: a 6-package `@sauruslord` / `zaldy-baileys` / `saurus-assets` Baileys WhatsApp-API fork cluster (retired inside a 65-second window at 05:11-05:12 UTC - same operator signature as the earlier `@skyzopedia/baileys-mod` and `lotusbail` WhatsApp-message-stealer campaigns), a 4-package `webpack-cache-cycle` / `webpack-session-cache` / `webpack-cache-reset` / `vite-config-optimizer` 35-day sleeper retired in a 15-second burst, and a healthcare-targeted `patientdocuments@75.0.0` + `fhirproxy-utils` FHIR-namespace dep-confusion pair.

- Published: 2026-07-15
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 25 packages, 56 compromised versions
- Tags: dependency-confusion, typosquat, dormant-domain, credential-theft, obfuscation, infostealer
- Also known as: 2026-07-15 GHSA npm sweep, sauruslord Baileys WhatsApp-fork cluster, webpack-cache dep-confusion sleeper
- Detected by: GitHub Advisory Database, npm Security, Hacktron
- Incident ID: npm-2026-07-15-ghsa-malware-sweep

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@achuthvp/postinstall-poc](https://dependencywatch.io/package/npm/@achuthvp/postinstall-poc) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [@bcs-mi-ui/message](https://dependencywatch.io/package/npm/@bcs-mi-ui/message) | npm | 1.0.2 |
| [@bcs-mi-ui/message-block](https://dependencywatch.io/package/npm/@bcs-mi-ui/message-block) | npm | 1.0.2 |
| [@bcs-mi-ui/test1243npmpacket76](https://dependencywatch.io/package/npm/@bcs-mi-ui/test1243npmpacket76) | npm | 1.0.2 |
| [@hkyyy/portal-widget-helper-0601](https://dependencywatch.io/package/npm/@hkyyy/portal-widget-helper-0601) | npm | 1.0.0 |
| [@saladin0x1/js-shared-modules](https://dependencywatch.io/package/npm/@saladin0x1/js-shared-modules) | npm | 1.11.6 |
| [@sauruslord/baileys](https://dependencywatch.io/package/npm/@sauruslord/baileys) | npm | 1.0.0, 1.0.1 |
| [@sauruslord/eslint-config](https://dependencywatch.io/package/npm/@sauruslord/eslint-config) | npm | 2.0.1, 2.0.2 |
| [@sauruslord/libsignal](https://dependencywatch.io/package/npm/@sauruslord/libsignal) | npm | 2.0.0 |
| [fhirproxy-utils](https://dependencywatch.io/package/npm/fhirproxy-utils) | npm | 1.0.8 |
| [gpu-accelerator](https://dependencywatch.io/package/npm/gpu-accelerator) | npm | 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7 |
| [js-shared-modules](https://dependencywatch.io/package/npm/js-shared-modules) | npm | 1.11.6, 1.11.7 |
| [ldpbootstrap-jquery](https://dependencywatch.io/package/npm/ldpbootstrap-jquery) | npm | 1.0.0, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16 |
| [patientdocuments](https://dependencywatch.io/package/npm/patientdocuments) | npm | 75.0.0 |
| [postcss-processor-utils](https://dependencywatch.io/package/npm/postcss-processor-utils) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3 |
| [saurus-assets](https://dependencywatch.io/package/npm/saurus-assets) | npm | 1.0.0 |
| [sauruslord-baileys](https://dependencywatch.io/package/npm/sauruslord-baileys) | npm | 1.0.2, 2.0.0, 3.0.2 |
| [ssweb-wp](https://dependencywatch.io/package/npm/ssweb-wp) | npm | 1.0.0 |
| [testzapier](https://dependencywatch.io/package/npm/testzapier) | npm | 1.0.0, 1.0.1 |
| [textshape-css](https://dependencywatch.io/package/npm/textshape-css) | npm | 1.0.0 |
| [vite-config-optimizer](https://dependencywatch.io/package/npm/vite-config-optimizer) | npm | 1.1.4 |
| [webpack-cache-cycle](https://dependencywatch.io/package/npm/webpack-cache-cycle) | npm | 0.1.4 |
| [webpack-cache-reset](https://dependencywatch.io/package/npm/webpack-cache-reset) | npm | 0.1.4 |
| [webpack-session-cache](https://dependencywatch.io/package/npm/webpack-session-cache) | npm | 0.1.4 |
| [zaldy-baileys](https://dependencywatch.io/package/npm/zaldy-baileys) | npm | 2.0.0 |

## What happened

On 2026-07-15 GitHub's Advisory Database published 25 CWE-506 (Embedded Malicious Code) advisories against npm packages. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate. Registry cross-reference against the npm `time` map revealed sharply distinct clusters, and the retirement timestamps show four coordinated take-down bursts:

## Cluster 1 - Baileys WhatsApp-fork credential-stealer cluster (6 packages)

| Package | Observed versions | First publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `@sauruslord/baileys` | `1.0.0`, `1.0.1` | 2026-03-05 15:18:54 | 2026-07-15 05:12:04 |
| `sauruslord-baileys` | 44 versions (`1.0.2`–`3.0.2`+) | 2026-03-05 15:40:23 | 2026-07-15 05:12:09 |
| `saurus-assets` | `1.0.0` | 2026-03-12 11:50:07 | 2026-07-15 05:11:53 |
| `zaldy-baileys` | `2.0.0` | 2026-03-23 11:03:38 | 2026-07-15 05:12:50 |
| `@sauruslord/eslint-config` | `2.0.1`, `2.0.2` | 2026-03-26 12:40:29 | 2026-07-15 05:12:41 |
| `@sauruslord/libsignal` | `2.0.0` | 2026-03-27 05:13:32 | 2026-07-15 05:12:19 |

All six packages are forks or accessories of [`@whiskeysockets/baileys`](https://www.npmjs.com/package/@whiskeysockets/baileys), the canonical TypeScript library for WhatsApp Web Multi-Device. `sauruslord-baileys` is the primary fork (44 point-release versions across Mar 5 → Jul 15 - a legitimate-looking maintenance cadence). `@sauruslord/baileys`, `@sauruslord/libsignal`, `saurus-assets`, `zaldy-baileys` are the scoped satellites and republishes. `@sauruslord/eslint-config` shipped a `2.0.2` bump on 2026-06-10 - the same publish date used by the webpack-cache dep-confusion cluster below, which is likely coincidental but worth noting.

All six retired in a **~65-second coordinated npm-Security take-down burst on 2026-07-15 05:11:53 → 05:12:50 UTC** - the same operator-signature pattern seen on the 2026-07-13 Spanish-enterprise `getd-*` retirement.

### Threat-model context: WhatsApp-bot supply-chain forks

The Baileys-fork pattern is the same shape as two well-documented earlier campaigns:

- **[`@skyzopedia/baileys-mod`](https://xygeni.io/blog/malicious-npm-package-in-baileys-fork-skyzopedia-case/)** (Xygeni disclosure): from version `8.0.1` onwards, runtime code injection in `lib/Socket/newsletter.js` silently subscribes the authenticated WhatsApp bot session to attacker-controlled newsletter channels 80 seconds after module load. Payload dynamically fetches its target list from GitHub, making the behavior self-updating and install-time-analysis-resistant.
- **[`lotusbail`](https://www.koi.ai/blog/npm-package-with-56k-downloads-malware-stealing-whatsapp-messages)** (Koi Security disclosure, ~56K downloads): fork of `@whiskeysockets/baileys` with four-layer obfuscation (Unicode variable manipulation, LZString compression, Base-91 encoding, AES encryption). Hardcoded AES-encrypted pairing code performs a WhatsApp link-device grant to the attacker's device that **survives package removal** - victims must manually unlink all devices in WhatsApp settings to revoke the attacker's persistent access.

The `@sauruslord` / `sauruslord-baileys` / `saurus-assets` / `zaldy-baileys` cluster fits the same shape and should be treated with the same threat model: install-time host compromise **plus** long-lived attacker access to any WhatsApp account the bot was ever paired with.

## Cluster 2 - Webpack / Vite `-cache-` / `-config-` 35-day dep-confusion sleeper (4 packages)

| Package | Version | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `vite-config-optimizer` | `1.1.4` | 2026-06-10 09:48:41 | 2026-07-15 03:40:41 |
| `webpack-cache-cycle` | `0.1.4` | 2026-06-10 08:27:58 | 2026-07-15 03:40:46 |
| `webpack-cache-reset` | `0.1.4` | 2026-06-10 08:02:25 | 2026-07-15 03:40:51 |
| `webpack-session-cache` | `0.1.4` | 2026-06-10 07:38:35 | 2026-07-15 03:40:56 |

All four packages published within a **50-minute window on 2026-06-10 07:38 → 09:48 UTC**, dormant for **35 days**, then retired in a **15-second npm-Security take-down burst on 2026-07-15 03:40:41 → 03:40:56 UTC**.

### Deceptive packaging - same operator across both namespaces

[Hacktron's analysis](https://www.hacktron.ai/package/npm/vite-config-optimizer/1.1.4) of `vite-config-optimizer@1.1.4` documents the attacker's cross-namespace tell: the `vite-config-optimizer` `package.json` declares its repository field as `webpack-tools/webpack-cache-plugin` and its main module exports a `WebpackCachePlugin` class. The `vite-*` slug is cover: the actual payload identifies as webpack tooling. This ties the `vite-config-optimizer` publish directly to the `webpack-cache-cycle` / `webpack-cache-reset` / `webpack-session-cache` triplet - the four names are the SAME operator broadening the dep-confusion catchment across both major bundler ecosystems.

### Payload chain (from the Hacktron analysis)

1. `postinstall` hook triggers `loader.js` on every `npm install`.
2. `loader.js` spawns a **detached child Node process** running a dropper - `child.unref()` hides the running dropper from the installer's process tree.
3. Dropper decodes a hidden URL via `Buffer.from(<hex-literal>, 'hex').toString()` - evades plain-text URL scanners that grep tarballs for `http(s)://` strings.
4. Fetches second-stage over HTTPS, writes it to a temp file, executes it inline with the installer's privileges.

No write-up exists for the three `webpack-*` packages but the shared operator makes it a safe bet the payload is identical or near-identical.

## Cluster 3 - Healthcare / FHIR dep-confusion pair (2 packages)

| Package | Version | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `patientdocuments` | `75.0.0` | 2026-05-31 17:08:31 | 2026-07-15 02:30:11 |
| `fhirproxy-utils` | `1.0.8` | 2026-05-31 12:14:47 | 2026-07-15 01:55:01 |

Both `patientdocuments` and `fhirproxy-utils` are internal-scope-shape names likely targeting a specific healthcare provider's internal Node.js integration project. The `patientdocuments@75.0.0` version pin is the fingerprint of a **dep-confusion version-race**: shipping a conspicuously high major version guarantees the malicious tarball beats any legitimate internal package resolution when the installer falls through to the public registry.

The `fhirproxy-utils` name aligns with the HL7 Fast Healthcare Interoperability Resources ecosystem, which is [publicly documented](https://www.fhir.org/guides/security-notices/2026-03-npm-dependencies.html) as historically susceptible to dep-confusion attacks because FHIR packages resolved through non-standard registries and were only pre-registered on npm as defensive stubs after the March 2026 HL7 security notice.

## Cluster 4 - `@bcs-mi-ui` internal-scope cluster (3 packages)

| Package | Version | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `@bcs-mi-ui/message` | `1.0.2` | 2026-05-17 16:06:52 | 2026-07-15 03:31:52 |
| `@bcs-mi-ui/message-block` | `1.0.2` | 2026-05-17 16:14:21 | 2026-07-15 03:32:01 |
| `@bcs-mi-ui/test1243npmpacket76` | `1.0.2` | 2026-05-24 11:40:20 | 2026-07-15 03:32:10 |

The `@bcs-mi-ui` scope shape (`bcs-mi` UI) points to an internal enterprise UI-component project. The `test1243npmpacket76` slug is the fingerprint of a leftover dep-confusion research/test push that got weaponized alongside the two production-looking `message` and `message-block` components. Retired in a **~20-second npm-Security take-down burst on 2026-07-15 03:31:52 → 03:32:10 UTC**.

## Cluster 5 - `js-shared-modules` scope-pair (2 packages)

| Package | Version | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `@saladin0x1/js-shared-modules` | `1.11.6` | 2026-05-24 18:17:05 | 2026-07-15 02:47:15 |
| `js-shared-modules` | `1.11.6`, `1.11.7` | 2026-05-24 18:20:33 | 2026-07-15 02:47:05 |

Classic dep-confusion scope-pair: a scoped package on a personal namespace (`@saladin0x1/js-shared-modules`) republished as an unscoped variant on the public registry. Any installer with scope-fallthrough behavior against an `@saladin0x1` internal-registry pin resolves the malicious unscoped tarball.

## Cluster 6 - Assorted singletons (8 packages)

| Package | Versions | Publish window (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `ssweb-wp` | `1.0.0` | 2026-06-03 12:42:48 | 2026-07-15 05:12:45 |
| `ldpbootstrap-jquery` | 17 versions `1.0.0`–`1.0.16` | 2026-06-09 → 2026-06-14 | 2026-07-15 03:57:36 |
| `testzapier` | `1.0.0`, `1.0.1` | 2026-06-04 17:10:37 → 17:18:20 | 2026-07-15 03:38:24 |
| `gpu-accelerator` | `1.4.2`–`1.4.7` | 2026-06-11 → 2026-06-12 | 2026-07-15 03:35:12 |
| `textshape-css` | `1.0.0` | 2026-06-19 05:54:02 | 2026-07-15 03:35:22 |
| `postcss-processor-utils` | `1.0.0`–`1.0.3` | 2026-06-10 12:38:40 → 20:21:31 | 2026-07-15 03:35:17 |
| `@achuthvp/postinstall-poc` | `1.0.0`–`1.0.3` | 2026-05-29 → 2026-06-03 | 2026-07-15 03:33:42 |
| `@hkyyy/portal-widget-helper-0601` | `1.0.0` | 2026-06-01 08:07:25 | 2026-07-15 02:52:41 |

Names span WordPress-adjacent (`ssweb-wp`), Linked-Data-Platform typosquat (`ldpbootstrap-jquery`), Zapier integration target (`testzapier`), generic ML/CUDA (`gpu-accelerator`), PostCSS tooling (`postcss-processor-utils`, `textshape-css`), self-labeled proof-of-concept (`@achuthvp/postinstall-poc` - GHSA treats it as live malware regardless of the honest slug), and an internal-scope helper (`@hkyyy/portal-widget-helper-0601` - the `0601` suffix likely reflects a dated internal-registry name pattern).

## Contrast with recent sweeps

| Date | Packages | Notes |
|---|---|---|
| 2026-07-06 | ~155 | Largest 2026 sweep |
| 2026-07-07 | ~65 | AI-SDK typosquats + Solana base58 |
| 2026-07-08 | ~20 | Claude-Code typosquat cluster |
| 2026-07-10 (early) | 25 | Epic Games / LuminaryCloud / Voyager dep-confusion + nodemon family |
| 2026-07-10 (late) / 2026-07-11 | 11 | Higher Logic / AT&T eBiz / Amtrav / babel-eslint dep-confusion + `type-*` 3.3.7 cluster + auth-typosquats |
| 2026-07-13 | 14 | Spanish-enterprise `getd-*` 40-day dep-confusion sleeper (10) + `pure-folder-three` poisoned bump + `dotnet-runtime-base` + `node-sysmetrics` + `@jplopezy/connectivity-test-do-not-install` |
| **2026-07-15** | **25** | **Baileys WhatsApp-fork credential-stealer cluster (6) + webpack/vite `-cache-` 35-day dep-confusion sleeper (4) + FHIR healthcare pair (2) + `@bcs-mi-ui` internal cluster (3) + `js-shared-modules` scope-pair (2) + 8 singletons** |

The running July 1–15 npm-malware retirement count is ~345 packages across 11 GHSA sweeps.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN for 24–72 hours after the security replacement lands and should be treated as live malware in any lockfile hit - regardless of exact version. Because the security replacement wipes the historical version list from the public registry response, the versions map below records the concrete versions observed pre-replacement via npm registry `time`-object inspection.

## Impact

- Any host that installed any of the 25 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
- **Baileys WhatsApp-fork credential-stealer cluster** (6 packages): `@sauruslord/baileys`, `@sauruslord/libsignal`, `@sauruslord/eslint-config`, `saurus-assets`, `sauruslord-baileys`, `zaldy-baileys`. All are typosquats or forks of the widely-used [`@whiskeysockets/baileys`](https://www.npmjs.com/package/@whiskeysockets/baileys) WhatsApp Multi-Device Web API library and its signal-protocol helpers. The pattern matches the earlier **@skyzopedia/baileys-mod** disclosure (Xygeni, runtime code injection in `lib/Socket/newsletter.js` that auto-subscribes the authenticated WhatsApp bot session to attacker-controlled newsletter channels 80s after module load) and the **lotusbail** disclosure (Koi Security, ~56K downloads, four-layer obfuscation, hardcoded AES-encrypted pairing code that link-devices the victim's WhatsApp session to the attacker permanently). `sauruslord-baileys` shipped 44 versions across Mar 5 → Jul 15 as a maintained fork before retirement. Impact is not just install-time host compromise - the attacker gets long-lived access to victim WhatsApp accounts (link-device grant survives package removal; victims must manually unlink devices in WhatsApp settings)
- **Webpack / Vite `-cache-` / `-config-` dep-confusion sleeper cluster** (4 packages): `webpack-cache-cycle`, `webpack-session-cache`, `webpack-cache-reset` (all `0.1.4` published 2026-06-10), `vite-config-optimizer` (`1.1.4` published 2026-06-10). All four retired in a **15-second take-down burst on 2026-07-15 03:40:41 → 03:40:56 UTC**. Hacktron's analysis of `vite-config-optimizer@1.1.4` documents the payload: a `postinstall` hook triggers `loader.js`, which spawns a **detached child Node process** running a dropper that hex-decodes a hidden URL via `Buffer.from(..., 'hex').toString()` (evades plain-text URL scanners), fetches the second-stage over HTTPS, writes it to a temp file, and executes arbitrary attacker-controlled JS inside the installer's Node process with installer privileges. Deceptive packaging: the `vite-config-optimizer` `package.json` declares its repository as `webpack-tools/webpack-cache-plugin` and its main module exports a `WebpackCachePlugin` class - the four packages are the SAME operator publishing under both `webpack-*` and `vite-*` namespaces to broaden the dep-confusion catchment (35-day dormancy Jun 10 → Jul 15 is deliberate ambient tactics identical to the Spanish-enterprise `getd-*` cluster retired 2026-07-13)
- **Healthcare / FHIR dep-confusion pair** (2 packages): `patientdocuments@75.0.0` (published 2026-05-31, note the **conspicuously high major version 75.x** - a classic dep-confusion version-race pin designed to beat any legitimate internal package on `npm install` semver resolution) and `fhirproxy-utils@1.0.8` (published 2026-05-31). Both point to a targeted campaign against a specific healthcare provider's internal npm namespace. FHIR (Fast Healthcare Interoperability Resources) is the HL7 healthcare-data standard whose npm packages are [publicly documented](https://www.fhir.org/guides/security-notices/2026-03-npm-dependencies.html) as susceptible to dependency-confusion attacks because FHIR packages historically resolved through non-standard registries. Any HL7-based healthcare integration project that had `patientdocuments` or `fhirproxy-utils` unscoped in its dependency graph resolved these malicious tarballs
- **`@bcs-mi-ui` internal-scope cluster** (3 packages): `@bcs-mi-ui/message`, `@bcs-mi-ui/message-block`, `@bcs-mi-ui/test1243npmpacket76` - all `1.0.2` published mid-to-late May 2026, retired in a 20-second window on 2026-07-15 03:31:52 → 03:32:10 UTC. The `test1243npmpacket76` slug is the fingerprint of a dep-confusion research/test push that got weaponized: a real attacker publishing under `@bcs-mi-ui` picked up the scope name, kept the leftover test-shaped slug alongside, and shipped a poisoned `message` component that a `bcs-mi` enterprise UI project would resolve via unscoped fallthrough
- **`js-shared-modules` scope-pair dep-confusion** (2 packages): `@saladin0x1/js-shared-modules@1.11.6` (scoped) + `js-shared-modules@1.11.6,1.11.7` (unscoped) both published 2026-05-24 → 2026-05-31 and retired 2026-07-15 02:47 UTC. Classic dep-confusion pattern: a legitimate scoped internal package gets shadowed by a maliciously-published unscoped variant on the public registry, hoping the installer misresolves
- **Assorted singletons** (8 packages) - `ssweb-wp` (WordPress-adjacent, `1.0.0` 2026-06-03), `ldpbootstrap-jquery` (17 versions Jun 9-14, `linked-data-platform`-shape typosquat), `testzapier` (2 versions Jun 4, Zapier integration target), `gpu-accelerator` (6 versions `1.4.2` → `1.4.7` Jun 11-12, generic ML/CUDA name), `textshape-css` (`1.0.0` Jun 19), `postcss-processor-utils` (4 versions Jun 10 with a rapid `1.0.0 → 1.0.3` burst), `@achuthvp/postinstall-poc` (4 versions late May–early Jun, self-labeled POC that GHSA treats as live malware regardless), `@hkyyy/portal-widget-helper-0601` (`1.0.0` 2026-06-01, internal-scope shape). Every retirement is a `0.0.1-security` npm-Security replacement
- No payload write-up accompanies most of the GHSA texts (only `vite-config-optimizer` has a public IOC analysis via Hacktron) - defenders should treat install-time behavior as unanalyzed for the other 24 packages and assume worst case for any host that resolved these names

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **If your WhatsApp bot / automation project imports any Baileys fork under `@sauruslord/*`, `sauruslord-baileys`, `zaldy-baileys`, or `saurus-assets`**: replace with the canonical [`@whiskeysockets/baileys`](https://www.npmjs.com/package/@whiskeysockets/baileys) fork upstream. **Manually unlink every device from WhatsApp settings** on any WhatsApp number the bot was ever paired with - the attacker-controlled pairing device persists after package removal, matching the [Koi Security lotusbail](https://www.koi.ai/blog/npm-package-with-56k-downloads-malware-stealing-whatsapp-messages) disclosure pattern. Assume every message sent/received during the exposure window was exfiltrated
3. **If you had any of `webpack-cache-cycle`, `webpack-session-cache`, `webpack-cache-reset`, or `vite-config-optimizer` in a lockfile**: none of these have legitimate parents on npm. The webpack build cache is a first-party feature; the canonical Vite tooling never publishes under `vite-config-optimizer`. Remove the dependencies. Because the payload spawns a detached unref'd child process, the malicious loader may still be running after `npm uninstall` - reboot the affected host and rotate any credential accessible from it
4. **If your organization ships FHIR / HL7-based healthcare integrations and had `patientdocuments` or `fhirproxy-utils` in a lockfile**: this is a targeted campaign against your internal namespace. Follow the [HL7 FHIR dependency-confusion mitigations](https://www.fhir.org/guides/security-notices/2026-03-npm-dependencies.html): use `--ignore-scripts` for all FHIR-adjacent installs, prefer the Firely terminal / FHIR validator to the raw npm client, and pin internal packages under an org-scoped namespace with `.npmrc` scope-registry routing (`@yourorg:registry=https://internal/`)
5. **If you had `@bcs-mi-ui/*`, `@saladin0x1/js-shared-modules`, `js-shared-modules`, or `@hkyyy/portal-widget-helper-0601` in a lockfile**: these are internal-scope dep-confusion shots. Audit for scope-fallthrough behavior; pin the internal registry as the primary source for all `@bcs-mi-ui`, `@saladin0x1`, `@hkyyy` scopes via `.npmrc`. Register the scopes as defensive stubs on the public registry
6. **If you had any singleton in a lockfile** (`ssweb-wp`, `ldpbootstrap-jquery`, `testzapier`, `gpu-accelerator`, `textshape-css`, `postcss-processor-utils`, `@achuthvp/postinstall-poc`): none have legitimate first-party parents. Remove; treat as a supply-chain incident
7. Verify none of the 25 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank, especially for the 35-day-dormant `webpack-cache-*` cluster whose names had 5+ weeks to be cached by pre-warm pipelines
8. For projects using `postinstall`-scripting packages, consider running `npm install --ignore-scripts` in CI as a defense-in-depth measure and re-invoking scripts only for vetted first-party packages (the upcoming npm v12 defaults do this, per the [npm v12 announcement](https://www.techtimes.com/articles/319890/20260708/npm-v12-ships-this-month-blocking-install-scripts-that-enabled-year-supply-chain-attacks.htm))

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-gq5v-w47h-r596 - @sauruslord/baileys malware advisory](https://github.com/advisories/GHSA-gq5v-w47h-r596) - GitHub
- [GHSA-p9pv-49fq-8f6m - @sauruslord/libsignal malware advisory](https://github.com/advisories/GHSA-p9pv-49fq-8f6m) - GitHub
- [GHSA-j2wh-xp56-gp35 - @sauruslord/eslint-config malware advisory](https://github.com/advisories/GHSA-j2wh-xp56-gp35) - GitHub
- [GHSA-hp4j-58vc-g6px - saurus-assets malware advisory](https://github.com/advisories/GHSA-hp4j-58vc-g6px) - GitHub
- [GHSA-h2r9-2p5m-9f8g - sauruslord-baileys malware advisory](https://github.com/advisories/GHSA-h2r9-2p5m-9f8g) - GitHub
- [GHSA-chjv-gxch-4gwg - zaldy-baileys malware advisory](https://github.com/advisories/GHSA-chjv-gxch-4gwg) - GitHub
- [GHSA-5rwj-cgwr-q954 - vite-config-optimizer malware advisory](https://github.com/advisories/GHSA-5rwj-cgwr-q954) - GitHub
- [GHSA-2p34-5qgm-wr3f - webpack-cache-cycle malware advisory](https://github.com/advisories/GHSA-2p34-5qgm-wr3f) - GitHub
- [GHSA-x29m-589q-wmg6 - webpack-cache-reset malware advisory](https://github.com/advisories/GHSA-x29m-589q-wmg6) - GitHub
- [GHSA-93h2-wqcj-75h4 - webpack-session-cache malware advisory](https://github.com/advisories/GHSA-93h2-wqcj-75h4) - GitHub
- [vite-config-optimizer 1.1.4 vulnerability report](https://www.hacktron.ai/package/npm/vite-config-optimizer/1.1.4) - Hacktron
- [GHSA-28q9-vg2f-r5m7 - patientdocuments malware advisory](https://github.com/advisories/GHSA-28q9-vg2f-r5m7) - GitHub
- [GHSA-cw9q-6cmp-p38r - fhirproxy-utils malware advisory](https://github.com/advisories/GHSA-cw9q-6cmp-p38r) - GitHub
- [HL7 FHIR - Potential Exploit: NPM Package Dependencies](https://www.fhir.org/guides/security-notices/2026-03-npm-dependencies.html) - HL7 FHIR
- [GHSA-4ppp-p4x6-p4w5 - @bcs-mi-ui/message malware advisory](https://github.com/advisories/GHSA-4ppp-p4x6-p4w5) - GitHub
- [GHSA-j6mx-7p76-j3h7 - @bcs-mi-ui/message-block malware advisory](https://github.com/advisories/GHSA-j6mx-7p76-j3h7) - GitHub
- [GHSA-9gp9-4wmv-j8qf - @bcs-mi-ui/test1243npmpacket76 malware advisory](https://github.com/advisories/GHSA-9gp9-4wmv-j8qf) - GitHub
- [GHSA-7xh4-j295-69xm - @saladin0x1/js-shared-modules malware advisory](https://github.com/advisories/GHSA-7xh4-j295-69xm) - GitHub
- [GHSA-57xw-xm2f-j2wc - js-shared-modules malware advisory](https://github.com/advisories/GHSA-57xw-xm2f-j2wc) - GitHub
- [GHSA-mcxp-9g3h-6rjx - ssweb-wp malware advisory](https://github.com/advisories/GHSA-mcxp-9g3h-6rjx) - GitHub
- [GHSA-2m3g-j8c8-hx83 - ldpbootstrap-jquery malware advisory](https://github.com/advisories/GHSA-2m3g-j8c8-hx83) - GitHub
- [GHSA-5ppv-rxq4-cf57 - testzapier malware advisory](https://github.com/advisories/GHSA-5ppv-rxq4-cf57) - GitHub
- [GHSA-qc67-wjjh-qpcv - gpu-accelerator malware advisory](https://github.com/advisories/GHSA-qc67-wjjh-qpcv) - GitHub
- [GHSA-pmmh-8m34-xxwh - textshape-css malware advisory](https://github.com/advisories/GHSA-pmmh-8m34-xxwh) - GitHub
- [GHSA-r5fg-j5cf-mfgx - postcss-processor-utils malware advisory](https://github.com/advisories/GHSA-r5fg-j5cf-mfgx) - GitHub
- [GHSA-rpc3-vhwp-44cv - @achuthvp/postinstall-poc malware advisory](https://github.com/advisories/GHSA-rpc3-vhwp-44cv) - GitHub
- [GHSA-wgx8-6mv9-p6jm - @hkyyy/portal-widget-helper-0601 malware advisory](https://github.com/advisories/GHSA-wgx8-6mv9-p6jm) - GitHub
- [Malicious npm Package in Baileys Fork (Skyzopedia Case) - related campaign context](https://xygeni.io/blog/malicious-npm-package-in-baileys-fork-skyzopedia-case/) - Xygeni
- [NPM Package With 56K Downloads Caught Stealing WhatsApp Messages - related campaign context (lotusbail)](https://www.koi.ai/blog/npm-package-with-56k-downloads-malware-stealing-whatsapp-messages) - Koi Security

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-15-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-15-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).