# GitHub Advisory npm malware sweep, 16 July 2026

> On 2026-07-16 and 2026-07-17 GitHub's Advisory Database retired 18 CWE-506 npm malware advisories (separate from 2 additional `chai-as-*` retirements folded into the existing jsonspack DPRK incident). Highlights: `anthropic-claude-latest` - a version-matched (`4.7.1` / `4.7.2` / `4.7.3`) typosquat of Anthropic's Claude Code CLI - and `claude-token-tracker-mcp`, an MCP-shape package targeting Claude Code's OAuth-token traffic (matching the Mitiga Labs "MCP token theft" attack chain that abuses `.claude.json`).

- Published: 2026-07-16
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 18 packages, 154 compromised versions
- Tags: typosquat, dependency-confusion, dormant-domain, credential-theft, obfuscation
- Also known as: 2026-07-16 GHSA npm sweep, anthropic-claude-latest Claude typosquat pair, chain-sdk-js mid-July SDK cluster, websight-p2p June 15 P2P burst
- Detected by: GitHub Advisory Database, npm Security, Mitiga Labs (attack-chain context)
- Incident ID: npm-2026-07-16-ghsa-malware-sweep

## Affected packages (18)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [ai-p2p](https://dependencywatch.io/package/npm/ai-p2p) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [ai-pro-sdk](https://dependencywatch.io/package/npm/ai-pro-sdk) | npm | 2.0.1, 2.0.2, 2.0.3, 2.0.4 |
| [anthropic-claude-latest](https://dependencywatch.io/package/npm/anthropic-claude-latest) | npm | 4.7.1, 4.7.2, 4.7.3 |
| [awesome-terminal](https://dependencywatch.io/package/npm/awesome-terminal) | npm | 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [chain-sdk-js](https://dependencywatch.io/package/npm/chain-sdk-js) | npm | 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [claude-token-tracker-mcp](https://dependencywatch.io/package/npm/claude-token-tracker-mcp) | npm | 1.0.0 |
| [hehehe](https://dependencywatch.io/package/npm/hehehe) | npm | 1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 2.0.1, 2.0.2 |
| [loader1](https://dependencywatch.io/package/npm/loader1) | npm | 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7 |
| [monogrok](https://dependencywatch.io/package/npm/monogrok) | npm | 1.0.1, 1.0.7, 1.0.8, 1.0.11, 1.0.14, 1.0.30, 1.0.31, 1.0.32, 1.0.33, 1.0.34, 1.0.35, 1.0.36, 1.0.37, 1.0.39, 1.0.40, 1.0.41, 1.0.43, 1.0.44 |
| [my-tailwind-gutenberg-block](https://dependencywatch.io/package/npm/my-tailwind-gutenberg-block) | npm | 0.1.0, 0.1.2, 0.1.3, 0.1.4, 0.1.5 |
| [px8my](https://dependencywatch.io/package/npm/px8my) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27, 1.0.28, 1.0.29, 1.0.30, 1.0.31, 1.0.32, 1.0.33, 1.0.34, 1.0.35, 1.0.36, 1.0.37, 1.0.38, 1.0.39, 1.0.40, 1.0.41, 1.0.42, 1.0.43, 1.0.44, 1.0.45, 1.0.46, 1.0.47, 1.0.48, 1.0.49, 1.0.50, 1.0.51, 1.0.52, 1.0.53, 1.0.54 |
| [scan-only](https://dependencywatch.io/package/npm/scan-only) | npm | 0.2.0, 0.3.0, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.5.0, 0.5.1, 1.0.0 |
| [terminal-mascot](https://dependencywatch.io/package/npm/terminal-mascot) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 3.5.2, 3.5.3 |
| [theta-sdk-js](https://dependencywatch.io/package/npm/theta-sdk-js) | npm | 1.2.14, 1.2.15, 1.2.16, 1.2.17 |
| [vor8zakon](https://dependencywatch.io/package/npm/vor8zakon) | npm | 1.0.0 |
| [websight-p2p](https://dependencywatch.io/package/npm/websight-p2p) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6 |
| [websight2-p2p](https://dependencywatch.io/package/npm/websight2-p2p) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [wordpad-text-ui](https://dependencywatch.io/package/npm/wordpad-text-ui) | npm | 1.0.0, 1.0.1, 1.0.2 |

## What happened

On 2026-07-16 and 2026-07-17 GitHub's Advisory Database published 20 CWE-506 (Embedded Malicious Code) advisories against npm packages. Two of them (`chai-as-const` and `chai-as-thread`) are the July continuation of the [jsonspack DPRK campaign already catalogued in the June 2026 incident](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack); the remaining **18** are captured here, grouped by publisher signature. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate.

## Cluster 1 - Claude / Anthropic-brand typosquat pair (2 packages)

| Package | Versions | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `anthropic-claude-latest` | `4.7.1`, `4.7.2`, `4.7.3` | 2026-06-20 11:50:16 → 12:31:01 | 2026-07-17 05:38:22 |
| `claude-token-tracker-mcp` | `1.0.0` | 2026-06-16 12:53:21 | 2026-07-16 06:50:13 |

### `anthropic-claude-latest`

The version pin `4.7.x` matches Anthropic's current [Claude Opus 4.7](https://www.anthropic.com/news/claude-opus-4-7) marketing name exactly - a developer trying to install a Claude-branded npm helper by memory (rather than reaching for the canonical `@anthropic-ai/claude-code` scope) hits this typosquat first. The three patch bumps `4.7.1` → `4.7.3` inside 41 minutes match the version-race pattern seen on other AI-tooling typosquats (`ai-pro-sdk` below, `openai-agents-helpers` on the 2026-07-07 sweep).

### `claude-token-tracker-mcp` and the Mitiga Labs MCP token-theft attack chain

The `claude-token-tracker-mcp` slug directly maps to [Mitiga Labs' June 2026 attack-chain disclosure](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm): a malicious npm package containing a hidden `postinstall` hook that rewrites `~/.claude.json` (Claude Code's global MCP configuration) to route all MCP traffic through an attacker-controlled localhost proxy. The proxy intercepts long-lived OAuth bearer tokens the developer has granted for connected SaaS platforms - Jira, Confluence, GitHub, and every other MCP server - while remaining indistinguishable from legitimate traffic on the provider side. Mitiga reported the attack chain to Anthropic on 2026-04-10; Anthropic ruled the report out of scope on 2026-04-12, citing user consent for the initial package install. No client-side patch has shipped, so the mitigation for any host that resolved `claude-token-tracker-mcp` is: audit `~/.claude.json` for unexpected `mcpServers.*.url` entries pointing at `localhost:*` or `127.0.0.1:*`, rotate every OAuth token the Claude Code session had granted, and reimage the affected workstation.

## Cluster 2 - Mid-July SDK-typosquat cluster (3 packages)

| Package | Versions | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `chain-sdk-js` | `1.0.2` → `1.0.6` | 2026-07-14 15:14:07 → 2026-07-15 21:30:58 | 2026-07-16 23:33:18 |
| `theta-sdk-js` | `1.2.14` → `1.2.17` | 2026-07-10 12:57:39 → 16:37:43 | 2026-07-16 23:55:37 |
| `ai-pro-sdk` | `2.0.1` → `2.0.4` | 2026-07-14 07:19:26 → 2026-07-16 07:39:46 | 2026-07-16 23:29:34 |

Three SDK-suffix names, each with 4-5 rapid patch bumps, retired inside a **~26-minute npm-Security take-down window on 2026-07-16 23:29 → 23:55 UTC**. `chain-sdk-js` targets Chainlink / generic crypto chain-SDK developers; `theta-sdk-js` maps to the Theta Network blockchain SDK; `ai-pro-sdk` is a broader AI-SDK typosquat continuing the `openai-agents-helpers` / `anthropic-toolkit` / `ai-sdk-helpers` cluster Socket flagged on 2026-07-07. The `2.0.4` version of `ai-pro-sdk` was published at 2026-07-16 07:39 UTC - only 16 hours before its own take-down, so the operator was still actively pushing new versions when npm Security caught up.

## Cluster 3 - June 15 P2P burst (3 packages)

| Package | Versions | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `websight-p2p` | `1.0.0` → `1.0.6` | 2026-06-14 17:35:54 → 17:59:22 | 2026-07-16 08:12:20 |
| `websight2-p2p` | `1.0.0` → `1.0.4` | 2026-06-15 18:58:24 → 19:09:58 | 2026-07-16 08:12:10 |
| `ai-p2p` | `1.0.0` → `1.0.4` | 2026-06-15 19:22:54 → 19:44:34 | 2026-07-16 08:11:52 |

All three packages fit the same fingerprint: **5-7 rapid patch bumps within a ~23-minute publish window**, dormant for **~31 days**, then retired in a **28-second npm-Security take-down burst on 2026-07-16 08:11:52 → 08:12:20 UTC**. Shared version pattern + same-day publication + same-burst retirement = single operator broadening the dep-confusion catchment across three P2P/WebRTC-shaped internal-project slugs.

## Cluster 4 - Auto-publisher sleepers (3 packages, ~92 versions combined)

| Package | Version count | Publish window (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `px8my` | **55 versions** `1.0.0` → `1.0.54` | 2026-06-18 10:08 → 2026-07-16 12:50 (daily cadence, ~30 days) | 2026-07-16 23:37:43 |
| `monogrok` | **21 versions** `1.0.1` → `1.0.44` | 2026-06-10 08:00 → 2026-07-16 22:08 | 2026-07-16 23:08:04 |
| `scan-only` | **16 versions** `0.2.0` → `1.0.0` | 2026-06-17 12:27 → 18:24 (~2-hour burst) | 2026-07-17 05:38:27 |

`px8my`'s 30-day daily-cadence version history (roughly one new patch every 6-12 hours from 2026-06-18 through 2026-07-16) is unusual for a dep-confusion typosquat. Two interpretations fit: (a) a compromised legitimate maintainer account whose auto-publish pipeline was hijacked, with malicious code injected only in the last few versions before retirement; (b) an attacker-run test harness that got weaponized during the window. Either way, all 55 versions should be treated as suspect in any lockfile hit - GHSA's "all versions" affected range makes no distinction.

`monogrok`'s 21-version cadence spans a slower ~5 week window and includes a large gap between 1.0.11 (2026-06-23) and 1.0.14 (2026-07-06), then rapid bumps in the final week - matching the "dormant then late-stage weaponization" tactic seen on the 2026-07-13 `getd-*` Spanish-enterprise sweep.

`scan-only`'s 16-version burst inside a 2-hour window on 2026-06-17 is the fingerprint of a dep-confusion race - the operator was iterating rapidly to nail the exact semver that would beat a specific internal package. The name aligns with a "scan-only mode" security-tool feature slug that has been publicly discussed as a Nessus / Nmap / Semgrep configuration flag.

## Cluster 5 - WordPress Gutenberg / terminal-toy fillers (4 packages)

| Package | Versions | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `my-tailwind-gutenberg-block` | `0.1.0` → `0.1.5` | 2026-07-16 16:31:22 → 21:00:42 | 2026-07-16 22:27:57 |
| `awesome-terminal` | `1.0.1` → `1.0.4` | 2026-07-11 08:29:06 → 2026-07-15 17:47:47 | 2026-07-16 23:31:42 |
| `terminal-mascot` | `1.0.0` → `3.5.3` | 2026-07-11 06:20:50 → 2026-07-15 17:52:05 | 2026-07-16 23:54:46 |
| `wordpad-text-ui` | `1.0.0` → `1.0.2` | 2026-06-16 02:35:29 → 02:43:26 | 2026-07-16 08:09:22 |

`my-tailwind-gutenberg-block` is the only package in this sweep to be published and retired the same day (2026-07-16) - 90 minutes between the final version push (21:00 UTC) and the GHSA replacement (22:27 UTC). The exposure window is narrow but the target is a WordPress Gutenberg block-editor build chain with elevated npm-install privileges on a plugin-developer's machine.

`awesome-terminal` and `terminal-mascot` were both published within the same 30-minute window on 2026-07-11 08:00 → 08:47 UTC - same-hour publish coordination points to a single operator. `terminal-mascot` also shows the classic version-race fingerprint: a jump from `1.0.3` to `3.5.2` inside 30 minutes to guarantee semver resolution beats any legitimate internal package.

## Cluster 6 - Singletons (3 packages)

| Package | Versions | Publish (UTC) | GHSA replacement (UTC) |
|---|---|---|---|
| `hehehe` | `1.0.0`–`1.0.7` + `2.0.1`, `2.0.2` | 2026-05-05 16:30 → 2026-07-15 20:34 | 2026-07-16 23:36:30 |
| `vor8zakon` | `1.0.0` | 2026-06-15 14:36:51 | 2026-07-16 07:27:42 |
| `loader1` | `2.1.2` → `2.1.7` | 2026-06-15 20:13:02 → 21:25:13 | 2026-07-16 08:12:03 |

`hehehe` is the odd one - an initial burst of `1.0.0..1.0.7` in May was likely benign / abandoned, then two `2.0.x` republishes on 2026-07-15 (12:04 → 20:34 UTC) triggered the retirement. Any host that resolved `2.0.1` or `2.0.2` is the actual exposure. `vor8zakon`'s slug (`vor` = "thief" in Russian, `zakon` = "law" - colloquially "the criminal code") is unusual and may point to a specific Russian-language internal target. `loader1` fits the generic-name dep-confusion pattern that has caught up seven bundler-tool typosquats already this month.

## Cross-cluster notes

- The **72 aggregate versions** across 18 packages compare to 145 versions across 25 packages on the 2026-07-15 sweep and roughly 60 versions across 14 packages on the 2026-07-13 sweep.
- The `anthropic-claude-latest` + `claude-token-tracker-mcp` pair is the first clear Claude / Anthropic brand-targeting we've seen in a GHSA sweep. Previous Claude-related supply-chain incidents (`mouse5212-claude-ai-exfil`, `mouse5212-super-formatter`) targeted Claude *artifact directories*, not the Anthropic brand namespace. Expect more `@anthropic-ai/*` and `claude-*` typosquats now that the pattern has proven successful.
- The July 16 retirements land while [Anthropic's own Claude Code CLI is under review](https://www.malwarebytes.com/blog/news/2026/07/claude-codes-hidden-tracker-was-an-experiment-says-anthropic) for a separate steganographic-tracker controversy - coincidence, but the two stories together mean any Claude-related npm search returns has to be triaged carefully.

## Registry state

Every package now resolves to a `0.0.1-security` holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN for 24-72 hours after the security replacement lands and should be treated as live malware in any lockfile hit - regardless of exact version. Because the security replacement wipes the historical version list from the public registry response, the versions map below records the concrete versions observed pre-replacement via npm registry `time`-object inspection.

## Impact

- Any host that installed any of the 18 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
- **Claude / Anthropic-brand typosquat pair** (2 packages): `anthropic-claude-latest@4.7.1,4.7.2,4.7.3` (published 2026-06-20 11:50 → 12:31 UTC) and `claude-token-tracker-mcp@1.0.0` (published 2026-06-16 12:53 UTC, retired 2026-07-16 06:50 UTC). The `4.7.x` version pin on `anthropic-claude-latest` is a deliberate lock to the current Claude Opus 4.7 marketing version - any developer trying to install a Claude-branded npm helper by memory (rather than the canonical `@anthropic-ai/claude-code`, `@anthropic-ai/sdk`, or `@anthropic-ai/tokenizer`) is the target. The `claude-token-tracker-mcp` name aligns with the [Mitiga Labs MCP token-theft attack chain](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm) in which a malicious npm package rewrites `~/.claude.json` on install to route Claude Code MCP traffic through an attacker localhost proxy, harvesting long-lived OAuth bearer tokens for every SaaS platform (Jira / Confluence / GitHub) the developer had connected. Anthropic told Mitiga the attack chain is out of scope pending user consent - no client-side patch will be shipped
- **Mid-July SDK-typosquat cluster** (3 packages): `chain-sdk-js@1.0.2..1.0.6` (2026-07-14 15:14 → 2026-07-15 21:30 UTC), `theta-sdk-js@1.2.14..1.2.17` (2026-07-10 12:57 → 16:37 UTC), `ai-pro-sdk@2.0.1..2.0.4` (2026-07-14 07:19 → 2026-07-16 07:39 UTC). All three share the same shape: SDK-suffix name, 3-6 rapid patch bumps in a single day, retired within 8 hours in the same npm-Security burst on 2026-07-16 23:29 → 23:55 UTC. The `chain-sdk-js` slug likely targets Chainlink / crypto chain-SDK developers; `theta-sdk-js` maps to the Theta Network blockchain SDK; `ai-pro-sdk` is a broader AI-SDK typosquat continuing the `openai-agents-helpers` / `anthropic-toolkit` / `ai-sdk-helpers` cluster Socket flagged on 2026-07-07
- **June 15 P2P burst** (3 packages): `ai-p2p@1.0.0..1.0.4`, `websight-p2p@1.0.0..1.0.6`, `websight2-p2p@1.0.0..1.0.4` - all published within a **72-minute window on 2026-06-14 17:35 → 2026-06-15 19:44 UTC**, retired in a **28-second npm-Security take-down burst on 2026-07-16 08:11:52 → 08:12:20 UTC**. Shared version-numbering pattern (`1.0.0` → `1.0.4/1.0.6` rapid patch bumps within minutes of first publish), same day publication, same retirement burst - one operator broadening the dep-confusion catchment across three P2P/WebRTC-shaped internal-project slugs
- **Auto-publisher sleepers with mass version histories** (3 packages): `px8my` (**55 versions** across **1.0.0 → 1.0.54** - a daily-cadence auto-publisher running 2026-06-18 → 2026-07-16, roughly 30 days of scheduled `npm publish` calls at similar times of day), `monogrok` (**21 versions** `1.0.1 → 1.0.44` across 2026-06-10 → 2026-07-16), `scan-only` (**16 versions** `0.2.0 → 1.0.0` in a **~2-hour burst** on 2026-06-17 12:27 → 18:24 UTC). `px8my`'s 30-day version cadence is unusual for a dep-confusion typosquat - it fits either (a) a compromised legitimate maintainer account with an auto-publish pipeline, or (b) an attacker-run test harness that got weaponized in the last few versions. `scan-only` is likely a security-tool internal name (aligns with a "scan-only mode" static-analyzer feature slug) that got typosquatted for a specific internal target
- **WordPress Gutenberg / terminal-toy fillers** (4 packages): `my-tailwind-gutenberg-block@0.1.0..0.1.5` (2026-07-16 same-day burst 16:31 → 21:00 UTC - the only package retired within hours of its first publish), `awesome-terminal@1.0.1..1.0.4` + `terminal-mascot@1.0.0..3.5.3` (both published 2026-07-11 08:00 → 08:47 UTC and retired 2026-07-16 23:31 → 23:54 UTC - same-hour publish coordination), `wordpad-text-ui@1.0.0..1.0.2` (2026-06-16 02:35 → 02:43 UTC). The `terminal-mascot` version jump from `1.0.3` to `3.5.2` inside 30 minutes is the fingerprint of a version-race dep-confusion pin
- **Singletons** (3 packages): `hehehe@1.0.0..2.0.2` (an odd 2-generation package with `1.0.x` versions from 2026-05-05 → 2026-05-20 and `2.0.1/2.0.2` republished 2026-07-15 12:04 → 20:34 UTC - the `2.0.x` payload is what triggered retirement), `vor8zakon@1.0.0` (single version 2026-06-15 14:36 UTC, retired 2026-07-16 07:27 UTC - likely a Russian-language internal slug, `vor` = "thief" / "zakon" = "law"), `loader1@2.1.2..2.1.7` (2026-06-15 20:13 → 21:25 UTC 6-version burst)
- No payload write-up accompanies the GHSA texts for any of these 18 packages - defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **If your project imports `anthropic-claude-latest` or `claude-token-tracker-mcp`**: replace with the canonical Anthropic-published packages - `@anthropic-ai/claude-code`, `@anthropic-ai/sdk`, `@anthropic-ai/tokenizer`, `@anthropic-ai/bedrock-sdk`, or `@anthropic-ai/vertex-sdk`. Always verify the `@anthropic-ai/` scope prefix. For `claude-token-tracker-mcp` specifically: audit `~/.claude.json` on every developer workstation for unexpected MCP server URLs pointing at `localhost:*` proxies (per the [Mitiga Labs attack chain](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm) - the malicious postinstall hook rewrites the file to route MCP traffic through an attacker-controlled localhost proxy). Rotate every OAuth token the Claude Code session had access to: GitHub, Jira, Confluence, and any other SaaS-connected MCP server
3. **If you had `chain-sdk-js`, `theta-sdk-js`, or `ai-pro-sdk` in a lockfile**: these are typosquats of well-known ecosystem SDKs. Use the canonical `@chainlink/contracts`, `@theta-labs/theta-js`, or the `ai` (`@vercel/ai-sdk`) / `openai` / `@anthropic-ai/sdk` packages depending on which real SDK you actually needed. Remove the malicious dependencies and rotate any credentials the CI environment could reach - build-time postinstall hooks reach cloud metadata, secrets stores, and any environment variables loaded by the runner
4. **If you had `ai-p2p`, `websight-p2p`, or `websight2-p2p` in a lockfile**: none of these have a legitimate first-party parent on npm. These are internal-project dep-confusion pins. Register the `-p2p`-suffix namespaces as defensive stubs on the public registry (`npm publish` an empty `@yourorg/p2p-*` package) and pin the internal registry as the primary source via `.npmrc` scope-registry routing
5. **If you had `px8my`, `monogrok`, or `scan-only` in a lockfile**: audit the 55/21/16 concrete versions individually (see packages map below). `px8my`'s 30-day auto-publish cadence means many teams pulled it into an automated dependency-refresh PR at some point during the window. `scan-only` in particular is likely to be a security-tool internal name - check whether your organization has an internal `scan-only` package on a private registry that this attacker was trying to dep-confuse
6. **If you had any of the terminal-toy / WordPress / singleton fillers** (`awesome-terminal`, `terminal-mascot`, `wordpad-text-ui`, `my-tailwind-gutenberg-block`, `hehehe`, `vor8zakon`, `loader1`): none have legitimate first-party parents. Remove; treat as a supply-chain incident. For `my-tailwind-gutenberg-block` specifically: audit any WordPress Gutenberg build pipeline that resolved this dependency - it was published and retired the same day, so the exposure window is narrow but the target is a WordPress plugin build chain with elevated CI access
7. Verify none of the 18 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
8. For projects using `postinstall`-scripting packages, consider running `npm install --ignore-scripts` in CI as a defense-in-depth measure and re-invoking scripts only for vetted first-party packages (the upcoming npm v12 defaults do this, per the [npm v12 announcement](https://www.techtimes.com/articles/319890/20260708/npm-v12-ships-this-month-blocking-install-scripts-that-enabled-year-supply-chain-attacks.htm))

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-j588-p757-86r9 - anthropic-claude-latest malware advisory](https://github.com/advisories/GHSA-j588-p757-86r9) - GitHub
- [GHSA-w56m-5ch4-5xjw - claude-token-tracker-mcp malware advisory](https://github.com/advisories/GHSA-w56m-5ch4-5xjw) - GitHub
- [MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain](https://www.mitiga.io/blog/claude-code-mcp-token-theft-mitm) - Mitiga Labs
- [GHSA-2p8p-vrrr-9f6c - chain-sdk-js malware advisory](https://github.com/advisories/GHSA-2p8p-vrrr-9f6c) - GitHub
- [GHSA-qj2r-27rj-cc82 - theta-sdk-js malware advisory](https://github.com/advisories/GHSA-qj2r-27rj-cc82) - GitHub
- [GHSA-pw5v-v543-v4mp - ai-pro-sdk malware advisory](https://github.com/advisories/GHSA-pw5v-v543-v4mp) - GitHub
- [GHSA-g5cv-hmr5-x42p - ai-p2p malware advisory](https://github.com/advisories/GHSA-g5cv-hmr5-x42p) - GitHub
- [GHSA-f4xq-pw58-878h - websight-p2p malware advisory](https://github.com/advisories/GHSA-f4xq-pw58-878h) - GitHub
- [GHSA-jqc8-qp8m-m77v - websight2-p2p malware advisory](https://github.com/advisories/GHSA-jqc8-qp8m-m77v) - GitHub
- [GHSA-9869-r2r5-fff6 - px8my malware advisory](https://github.com/advisories/GHSA-9869-r2r5-fff6) - GitHub
- [GHSA-548c-qh8j-h895 - monogrok malware advisory](https://github.com/advisories/GHSA-548c-qh8j-h895) - GitHub
- [GHSA-72g3-g9xj-wxp6 - scan-only malware advisory](https://github.com/advisories/GHSA-72g3-g9xj-wxp6) - GitHub
- [GHSA-mhvw-mw3c-6mc5 - my-tailwind-gutenberg-block malware advisory](https://github.com/advisories/GHSA-mhvw-mw3c-6mc5) - GitHub
- [GHSA-cv56-pvc8-j5rg - awesome-terminal malware advisory](https://github.com/advisories/GHSA-cv56-pvc8-j5rg) - GitHub
- [GHSA-g2cj-hj2c-phvf - terminal-mascot malware advisory](https://github.com/advisories/GHSA-g2cj-hj2c-phvf) - GitHub
- [GHSA-83j8-j97r-9p9h - wordpad-text-ui malware advisory](https://github.com/advisories/GHSA-83j8-j97r-9p9h) - GitHub
- [GHSA-f5qh-v92x-xcxj - hehehe malware advisory](https://github.com/advisories/GHSA-f5qh-v92x-xcxj) - GitHub
- [GHSA-9f89-97fj-pqmp - vor8zakon malware advisory](https://github.com/advisories/GHSA-9f89-97fj-pqmp) - GitHub
- [GHSA-wp48-4xqv-v7fq - loader1 malware advisory](https://github.com/advisories/GHSA-wp48-4xqv-v7fq) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-16-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-16-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).