GitHub Advisory malware sweep — 8 npm packages (3-package `syft-acp-*` "click2ai" dep-confusion beacon, 2-package `@edgecommons/*` preinstall-hook pair, `axios-native` + `telemetry-axios` axios typosquats, `easyway2` 12-version 4-hour burst) retired 2026-07-17 → 2026-07-18

What happened

On 2026-07-17 and 2026-07-18 GitHub's Advisory Database published 8 CWE-506 (Embedded Malicious Code) advisories against npm packages, grouped by publisher signature. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised — rotate all secrets from a different computer" boilerplate.

Cluster 1 — click2ai dependency-confusion reconnaissance trio (3 packages)

| Package | Version | Publish (UTC) | npm unpublish (UTC) | |---|---|---|---| | syft-acp-atoms | 14.8.68 | 2026-07-16 08:45:48 | 2026-07-16 12:54:27 | | syft-acp-core | 16.0.0 | 2026-07-16 08:46:14 | 2026-07-16 12:54:29 | | syft-acp-uikit | 1.9.45 | 2026-07-16 08:46:40 | 2026-07-16 12:54:30 |

All three were published by npm account ada8877 (contact k3mlol@proton.mail) within a 52-second burst on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC — an exposure window of about 4 hours. The extreme version numbers (16.0.0, 14.8.68, 1.9.45) fit the classic dependency-confusion pattern: pick a version higher than any plausible internal semver so a misconfigured resolver picks the public tarball over the private one.

The verify.js reconnaissance payload

Each package ships a preinstall hook that:

1. Installs @sentry/node as a runtime dependency at install time.
2. Executes examples/verify.js, which queries https://1.1.1.1/cdn-cgi/trace with spoofed Chrome / Safari / Firefox User-Agent headers to extract the victim's public egress IP without any explicit "am I behind a proxy" tell.
3. Collects host telemetry — hostname, OS username, runtime engine (Node.js version + platform), env-var sample.
4. Beacons the composite record to the attacker-controlled Sentry project 4511744089718784 at o4510485815754752.ingest.us.sentry.io, using the standard Sentry DSN transport.

Each of the three package names reports to a distinct Sentry project id inside the same attacker Sentry organization, so the operator can distinguish which package name the misconfigured resolver actually picked. This is a reconnaissance beacon, not a full credential stealer — its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier click2ai-* reconnaissance packages (Socket / Microsoft tracked a related dep-confusion campaign against nine organizational scopes in May 2026; the payload lineage matches).

Why the syft-acp-* names

The name pattern — syft-<company>-<generic-slug> — points at an internal scope belonging to a specific enterprise. Syft is either the Anchore SBOM tool (in which case acp is likely an unrelated slug), or the internal branding of a UK-based fintech that operates a private syft-acp-* npm scope. The trio was published together to maximize the chance of any single misconfigured resolver leaking; version numbers were chosen to look plausible (14.8.68 is close enough to a real 14.x monorepo counter to pass a version-check without human eyes).

Cluster 2 — @edgecommons preinstall-hook pair (2 packages)

| Package | Ecosystem | Retired (UTC) | |---|---|---| | @edgecommons/streamlog-node | npm | 2026-07-18 | | @edgecommons/edgecommons | npm | 2026-07-18 |

Both packages were fully unpublished from npm (no 0.0.1-security replacement tarball remains). GHSA-4rqf-6883-f59f and GHSA-8p39-h6xv-p2g9 confirm a preinstall hook that executes on npm install, collects host telemetry, and beacons to an attacker-controlled endpoint. The @edgecommons scope shape (organization name + generic infra slug like streamlog-node) matches the same dependency-confusion pattern the click2ai trio uses.

Cluster 3 — axios typosquats (2 packages)

| Package | Security replacement (UTC) | |---|---| | axios-native | 2026-07-17 23:08:05 | | telemetry-axios | 2026-07-17 23:08:10 |

Both packages were npm-security-replaced within a 5-second window at 2026-07-17 23:08 UTC (23:08:02 → 23:08:10 UTC). Neither has a legitimate first-party parent — they exploit the fame of the axios HTTP client library, one of the top-10 most-downloaded npm packages. Original version tarballs are no longer resolvable on the public registry, so the GHSA "all versions" affected range makes no distinction. Any lockfile pin against either name indicates historical install; the fixed replacement is the canonical axios package.

Cluster 4 — easyway2 12-version 4-hour burst (1 package)

| Package | Versions | Publish window (UTC) | npm unpublish (UTC) | |---|---|---|---| | easyway2 | 1.0.0 → 1.0.11 (12 versions) | 2026-07-17 11:42 → 14:31 | 2026-07-17 16:31 |

GHSA-68c2-54w2-m326 flags 1.0.3 and 1.0.7 specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic. The full 12-version burst in a 2-hour window suggests dep-confusion race iteration — the operator was rapidly patching the tarball to survive a specific resolver behavior. All 12 versions were npm-unpublished at 2026-07-17 16:31 UTC, about 2 hours after the final version pushed — an unusually fast take-down.

Registry state

The syft-acp-* trio, @edgecommons/* pair, and easyway2 were all fully unpublished from npm (no security-replacement tarball). The axios-native + telemetry-axios pair received the standard 0.0.1-security replacement. In both cases, private registry mirrors that cached the tarballs during the publish window WILL keep serving the malicious versions after the public yank — any lockfile hit must be treated as active malware regardless of what the public registry currently returns.

Affected packages (8)

Impact

• Any host that installed any of the 8 packages below should be treated as fully compromised — every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists
• click2ai dependency-confusion reconnaissance trio (3 packages): syft-acp-core@16.0.0, syft-acp-uikit@1.9.45, syft-acp-atoms@14.8.68 were all published by npm account ada8877 (contact k3mlol@proton.mail) within a 52-second burst on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC (about 4 hours after publish). The extreme version numbers (16.0.0, 14.8.68, 1.9.45) are classic dep-confusion pins designed to beat the semver of a target org's internal syft-acp-* scope — the naming pattern points at a specific enterprise scope resolver misconfiguration. A preinstall hook installs @sentry/node at install time and runs examples/verify.js, which spoofs a browser User-Agent, queries Cloudflare's 1.1.1.1/cdn-cgi/trace to leak the victim's public egress IP, then beacons hostname + OS username + runtime metadata to the attacker-controlled Sentry project 4511744089718784 at o4510485815754752.ingest.us.sentry.io. Each of the three per-namespace beacons reports to a distinct Sentry project id so the operator can tell which of the three package names actually resolved on a victim host — this is a reconnaissance beacon, not a full RCE payload, and its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier click2ai-* reconnaissance packages
• @edgecommons preinstall-hook pair (2 packages): @edgecommons/streamlog-node and @edgecommons/edgecommons — both fully unpublished from npm (no security replacement tarball remains), retired via GHSA on 2026-07-18. GHSA records confirm a preinstall hook that collects host telemetry and beacons to an attacker-controlled endpoint. The @edgecommons scope shape (organization name + generic infra slug like streamlog-node) matches the same dependency-confusion pattern the click2ai trio uses
• axios typosquats (2 packages): axios-native@1.0.0 and telemetry-axios@1.0.0 were both republished as 0.0.1-security npm-security tarballs at 2026-07-17 23:08 UTC in the same 5-second window (23:08:02 → 23:08:10 UTC). Neither package has a legitimate first-party parent — they exploit the fame of the axios HTTP library. GHSA classifies both as full-compromise CWE-506 malware; original version tarballs are no longer resolvable but any lockfile pin against these names indicates historical install
• easyway2 singleton (1 package): 12 versions 1.0.0 → 1.0.11 published in a 4-hour burst on 2026-07-17 11:42 → 14:31 UTC, then npm-unpublished the same day at 16:31 UTC (roughly 2 hours after the final version pushed). GHSA advisory GHSA-68c2-54w2-m326 flags 1.0.3 and 1.0.7 specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic; the sibling versions in the burst all share the same tarball fingerprint per the OpenSSF Package Analysis dataset and should be treated as equally malicious
• None of the 8 packages have surviving version tarballs on the public npm registry — either fully unpublished within hours of first publish, or replaced with 0.0.1-security sentinel tarballs. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached the tarballs during the 4-hour publish window WILL keep serving the malicious versions after the public yank — lockfile hits on these names must be treated as active malware regardless of what the public registry currently returns

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. 2If you had syft-acp-core, syft-acp-uikit, or syft-acp-atoms in a lockfile: this indicates a misconfigured internal-registry resolver — the names suggest your organization has (or once had) a private syft-acp-* scope on an internal Verdaccio / Artifactory. Audit the resolver order in .npmrc (private registry MUST be listed before the public registry for internal-scope names), register defensive stubs on the public npm registry for every internal package name you care about (npm publish empty packages under those exact names to prevent future dep-confusion), and consider migrating internal syft-acp-* names to a scoped namespace (@yourorg/*) with .npmrc scope-registry routing so the public registry is never queried for these names
3. 3*Also for the `syft-acp- trio**: audit outbound network traffic during the 2026-07-16 08:45 → 12:54 UTC window for POST requests to o4510485815754752.ingest.us.sentry.io — any hit indicates a successful reconnaissance beacon and the affected host is on the operator's follow-on target list. Rotate every credential the affected host could reach, particularly any internal-service credentials that a preinstall` hook could enumerate via environment variable inspection
4. 4If you had @edgecommons/streamlog-node or @edgecommons/edgecommons in a lockfile: these have no legitimate first-party parent on npm. The @edgecommons scope shape strongly suggests a dependency-confusion pin against an internal @edgecommons/* scope; register defensive stubs on the public registry and configure .npmrc scope-registry routing to force @edgecommons/* resolution through your internal mirror only
5. 5If you had axios-native or telemetry-axios in a lockfile: these are pure axios-brand typosquats with no legitimate parent. Replace with the canonical axios package, remove the malicious dependencies, and rotate every credential the CI environment could reach — the postinstall execution path reaches cloud metadata, secrets stores, and environment variables loaded by the runner
6. 6If you had easyway2 in a lockfile: any of the 12 versions 1.0.0 → 1.0.11 should be treated as compromised. Grep for all 12 pins individually — a lockfile that resolved to 1.0.5 (for example) is just as compromised as one that resolved to 1.0.7, since the tarballs share the OpenSSF-flagged outbound-C2 fingerprint
7. 7Verify none of the 8 listed packages still resolves via your private mirror — internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
8. 8For projects using postinstall-scripting packages, consider running npm install --ignore-scripts in CI as a defense-in-depth measure and re-invoking scripts only for vetted first-party packages

References

• GitHub Advisory Database — recent npm malware advisories

  github.com
  GitHub
• GHSA-289v-6j56-44w8 — syft-acp-core malware advisory

  github.com
  GitHub
• GHSA-rvgp-458h-wjc3 — syft-acp-uikit malware advisory

  github.com
  GitHub
• GHSA-j5f4-f3f3-634h — syft-acp-atoms malware advisory

  github.com
  GitHub
• GHSA-4rqf-6883-f59f — @edgecommons/streamlog-node malware advisory

  github.com
  GitHub
• GHSA-8p39-h6xv-p2g9 — @edgecommons/edgecommons malware advisory

  github.com
  GitHub
• GHSA-9j78-5mc3-56h7 — axios-native malware advisory

  github.com
  GitHub
• GHSA-89mf-39r2-ff96 — telemetry-axios malware advisory

  github.com
  GitHub
• GHSA-68c2-54w2-m326 — easyway2 malware advisory

  github.com
  GitHub