GitHub Advisory npm malware sweep, 18 July 2026

HighAdvisory sweepnpm

On 2026-07-17 and 2026-07-18 GitHub's Advisory Database retired 8 CWE-506 npm malware advisories. Highlights: a 3-package syft-acp-* dependency-confusion trio published by npm account ada8877 that beacons victim IP + hostname to a Sentry ingest endpoint (byte-for-byte reuse of the earlier "click2ai" reconnaissance payload), a 2-package @edgecommons/* preinstall-hook pair, and axios typosquats axios-native + telemetry-axios.

Published 18 Jul 2026

Check your package-lock.json Source advisory

At a glancenpm-2026-07-18-ghsa-malware-sweep

Packages tracked19 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity: High
Type: Advisory sweep
Published: 18 Jul 2026
Ecosystems: npm
Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security
Also known as: 2026-07-18 GHSA npm sweep, click2ai syft-acp reconnaissance trio, @edgecommons preinstall pair
Source: github.com

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

On 2026-07-17 and 2026-07-18 GitHub's Advisory Database published 8 CWE-506 (Embedded Malicious Code) advisories against npm packages, grouped by publisher signature. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate.

Cluster 1 - click2ai dependency-confusion reconnaissance trio (3 packages)

Package	Version	Publish (UTC)	npm unpublish (UTC)
`syft-acp-atoms`	`14.8.68`	2026-07-16 08:45:48	2026-07-16 12:54:27
`syft-acp-core`	`16.0.0`	2026-07-16 08:46:14	2026-07-16 12:54:29
`syft-acp-uikit`	`1.9.45`	2026-07-16 08:46:40	2026-07-16 12:54:30

All three were published by npm account ada8877 (contact k3mlol@proton.mail) within a 52-second burst on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC - an exposure window of about 4 hours. The extreme version numbers (16.0.0, 14.8.68, 1.9.45) fit the classic dependency-confusion pattern: pick a version higher than any plausible internal semver so a misconfigured resolver picks the public tarball over the private one.

The `verify.js` reconnaissance payload

Each package ships a preinstall hook that:

Installs @sentry/node as a runtime dependency at install time.
Executes examples/verify.js, which queries https://1.1.1.1/cdn-cgi/trace with spoofed Chrome / Safari / Firefox User-Agent headers to extract the victim's public egress IP without any explicit "am I behind a proxy" tell.
Collects host telemetry - hostname, OS username, runtime engine (Node.js version + platform), env-var sample.
Beacons the composite record to the attacker-controlled Sentry project 4511744089718784 at o4510485815754752.ingest.us.sentry.io, using the standard Sentry DSN transport.

Each of the three package names reports to a distinct Sentry project id inside the same attacker Sentry organization, so the operator can distinguish which package name the misconfigured resolver actually picked. This is a reconnaissance beacon, not a full credential stealer - its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier click2ai-* reconnaissance packages (Socket / Microsoft tracked a related dep-confusion campaign against nine organizational scopes in May 2026; the payload lineage matches).

Why the `syft-acp-*` names

The name pattern - syft-<company>-<generic-slug> - points at an internal scope belonging to a specific enterprise. Syft is either the Anchore SBOM tool (in which case acp is likely an unrelated slug), or the internal branding of a UK-based fintech that operates a private syft-acp-* npm scope. The trio was published together to maximize the chance of any single misconfigured resolver leaking; version numbers were chosen to look plausible (14.8.68 is close enough to a real 14.x monorepo counter to pass a version-check without human eyes).

Cluster 2 - @edgecommons preinstall-hook pair (2 packages)

Package	Ecosystem	Retired (UTC)
`@edgecommons/streamlog-node`	npm	2026-07-18
`@edgecommons/edgecommons`	npm	2026-07-18

Both packages were fully unpublished from npm (no 0.0.1-security replacement tarball remains). GHSA-4rqf-6883-f59f and GHSA-8p39-h6xv-p2g9 confirm a preinstall hook that executes on npm install, collects host telemetry, and beacons to an attacker-controlled endpoint. The @edgecommons scope shape (organization name + generic infra slug like streamlog-node) matches the same dependency-confusion pattern the click2ai trio uses.

Cluster 3 - axios typosquats (2 packages)

Package	Security replacement (UTC)
`axios-native`	2026-07-17 23:08:05
`telemetry-axios`	2026-07-17 23:08:10

Both packages were npm-security-replaced within a 5-second window at 2026-07-17 23:08 UTC (23:08:02 → 23:08:10 UTC). Neither has a legitimate first-party parent - they exploit the fame of the axios HTTP client library, one of the top-10 most-downloaded npm packages. Original version tarballs are no longer resolvable on the public registry, so the GHSA "all versions" affected range makes no distinction. Any lockfile pin against either name indicates historical install; the fixed replacement is the canonical axios package.

Cluster 4 - `easyway2` 12-version 4-hour burst (1 package)

Package	Versions	Publish window (UTC)	npm unpublish (UTC)
`easyway2`	`1.0.0` → `1.0.11` (12 versions)	2026-07-17 11:42 → 14:31	2026-07-17 16:31

GHSA-68c2-54w2-m326 flags 1.0.3 and 1.0.7 specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic. The full 12-version burst in a 2-hour window suggests dep-confusion race iteration - the operator was rapidly patching the tarball to survive a specific resolver behavior. All 12 versions were npm-unpublished at 2026-07-17 16:31 UTC, about 2 hours after the final version pushed - an unusually fast take-down.

Registry state

The syft-acp-* trio, @edgecommons/* pair, and easyway2 were all fully unpublished from npm (no security-replacement tarball). The axios-native + telemetry-axios pair received the standard 0.0.1-security replacement. In both cases, private registry mirrors that cached the tarballs during the publish window WILL keep serving the malicious versions after the public yank - any lockfile hit must be treated as active malware regardless of what the public registry currently returns.

typosquatdependency-confusioncredential-theftobfuscation

Affected packages

8 packages 19 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →

Impact

What it does if you installed it

Any host that installed any of the 8 packages below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists
click2ai dependency-confusion reconnaissance trio (3 packages): syft-acp-core@16.0.0, syft-acp-uikit@1.9.45, syft-acp-atoms@14.8.68 were all published by npm account ada8877 (contact k3mlol@proton.mail) within a 52-second burst on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC (about 4 hours after publish). The extreme version numbers (16.0.0, 14.8.68, 1.9.45) are classic dep-confusion pins designed to beat the semver of a target org's internal syft-acp-* scope - the naming pattern points at a specific enterprise scope resolver misconfiguration. A preinstall hook installs @sentry/node at install time and runs examples/verify.js, which spoofs a browser User-Agent, queries Cloudflare's 1.1.1.1/cdn-cgi/trace to leak the victim's public egress IP, then beacons hostname + OS username + runtime metadata to the attacker-controlled Sentry project 4511744089718784 at o4510485815754752.ingest.us.sentry.io. Each of the three per-namespace beacons reports to a distinct Sentry project id so the operator can tell which of the three package names actually resolved on a victim host - this is a reconnaissance beacon, not a full RCE payload, and its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier click2ai-* reconnaissance packages
@edgecommons preinstall-hook pair (2 packages): @edgecommons/streamlog-node and @edgecommons/edgecommons - both fully unpublished from npm (no security replacement tarball remains), retired via GHSA on 2026-07-18. GHSA records confirm a preinstall hook that collects host telemetry and beacons to an attacker-controlled endpoint. The @edgecommons scope shape (organization name + generic infra slug like streamlog-node) matches the same dependency-confusion pattern the click2ai trio uses
axios typosquats (2 packages): axios-native@1.0.0 and telemetry-axios@1.0.0 were both republished as 0.0.1-security npm-security tarballs at 2026-07-17 23:08 UTC in the same 5-second window (23:08:02 → 23:08:10 UTC). Neither package has a legitimate first-party parent - they exploit the fame of the axios HTTP library. GHSA classifies both as full-compromise CWE-506 malware; original version tarballs are no longer resolvable but any lockfile pin against these names indicates historical install
easyway2 singleton (1 package): 12 versions 1.0.0 → 1.0.11 published in a 4-hour burst on 2026-07-17 11:42 → 14:31 UTC, then npm-unpublished the same day at 16:31 UTC (roughly 2 hours after the final version pushed). GHSA advisory GHSA-68c2-54w2-m326 flags 1.0.3 and 1.0.7 specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic; the sibling versions in the burst all share the same tarball fingerprint per the OpenSSF Package Analysis dataset and should be treated as equally malicious
None of the 8 packages have surviving version tarballs on the public npm registry - either fully unpublished within hours of first publish, or replaced with 0.0.1-security sentinel tarballs. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached the tarballs during the 4-hour publish window WILL keep serving the malicious versions after the public yank - lockfile hits on these names must be treated as active malware regardless of what the public registry currently returns

What to do

Clean-up steps

Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
If you had syft-acp-core, syft-acp-uikit, or syft-acp-atoms in a lockfile: this indicates a misconfigured internal-registry resolver - the names suggest your organization has (or once had) a private syft-acp-* scope on an internal Verdaccio / Artifactory. Audit the resolver order in .npmrc (private registry MUST be listed before the public registry for internal-scope names), register defensive stubs on the public npm registry for every internal package name you care about (npm publish empty packages under those exact names to prevent future dep-confusion), and consider migrating internal syft-acp-* names to a scoped namespace (@yourorg/*) with .npmrc scope-registry routing so the public registry is never queried for these names
*Also for the `syft-acp- trio**: audit outbound network traffic during the 2026-07-16 08:45 → 12:54 UTC window for POST requests to o4510485815754752.ingest.us.sentry.io - any hit indicates a successful reconnaissance beacon and the affected host is on the operator's follow-on target list. Rotate every credential the affected host could reach, particularly any internal-service credentials that a preinstall` hook could enumerate via environment variable inspection
If you had @edgecommons/streamlog-node or @edgecommons/edgecommons in a lockfile: these have no legitimate first-party parent on npm. The @edgecommons scope shape strongly suggests a dependency-confusion pin against an internal @edgecommons/* scope; register defensive stubs on the public registry and configure .npmrc scope-registry routing to force @edgecommons/* resolution through your internal mirror only
If you had axios-native or telemetry-axios in a lockfile: these are pure axios-brand typosquats with no legitimate parent. Replace with the canonical axios package, remove the malicious dependencies, and rotate every credential the CI environment could reach - the postinstall execution path reaches cloud metadata, secrets stores, and environment variables loaded by the runner
If you had easyway2 in a lockfile: any of the 12 versions 1.0.0 → 1.0.11 should be treated as compromised. Grep for all 12 pins individually - a lockfile that resolved to 1.0.5 (for example) is just as compromised as one that resolved to 1.0.7, since the tarballs share the OpenSSF-flagged outbound-C2 fingerprint
Verify none of the 8 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
For projects using postinstall-scripting packages, consider running npm install --ignore-scripts in CI as a defense-in-depth measure and re-invoking scripts only for vetted first-party packages

References

Sources

npm-2026-07-18-ghsa-malware-sweepBack to incidents Submit a correction

Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.json All incidents