# GitHub Advisory npm malware sweep, 18 July 2026

> On 2026-07-17 and 2026-07-18 GitHub's Advisory Database retired 8 CWE-506 npm malware advisories. Highlights: a 3-package `syft-acp-*` dependency-confusion trio published by npm account `ada8877` that beacons victim IP + hostname to a Sentry ingest endpoint (byte-for-byte reuse of the earlier "click2ai" reconnaissance payload), a 2-package `@edgecommons/*` preinstall-hook pair, and axios typosquats `axios-native` + `telemetry-axios`.

- Published: 2026-07-18
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 8 packages, 19 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, obfuscation
- Also known as: 2026-07-18 GHSA npm sweep, click2ai syft-acp reconnaissance trio, @edgecommons preinstall pair
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-07-18-ghsa-malware-sweep

## Affected packages (8)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@edgecommons/edgecommons](https://dependencywatch.io/package/npm/@edgecommons/edgecommons) | npm | 1.0.0 |
| [@edgecommons/streamlog-node](https://dependencywatch.io/package/npm/@edgecommons/streamlog-node) | npm | 1.0.0 |
| [axios-native](https://dependencywatch.io/package/npm/axios-native) | npm | 1.0.0 |
| [easyway2](https://dependencywatch.io/package/npm/easyway2) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11 |
| [syft-acp-atoms](https://dependencywatch.io/package/npm/syft-acp-atoms) | npm | 14.8.68 |
| [syft-acp-core](https://dependencywatch.io/package/npm/syft-acp-core) | npm | 16.0.0 |
| [syft-acp-uikit](https://dependencywatch.io/package/npm/syft-acp-uikit) | npm | 1.9.45 |
| [telemetry-axios](https://dependencywatch.io/package/npm/telemetry-axios) | npm | 1.0.0 |

## What happened

On 2026-07-17 and 2026-07-18 GitHub's Advisory Database published 8 CWE-506 (Embedded Malicious Code) advisories against npm packages, grouped by publisher signature. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" boilerplate.

## Cluster 1 - click2ai dependency-confusion reconnaissance trio (3 packages)

| Package | Version | Publish (UTC) | npm unpublish (UTC) |
|---|---|---|---|
| `syft-acp-atoms` | `14.8.68` | 2026-07-16 08:45:48 | 2026-07-16 12:54:27 |
| `syft-acp-core` | `16.0.0` | 2026-07-16 08:46:14 | 2026-07-16 12:54:29 |
| `syft-acp-uikit` | `1.9.45` | 2026-07-16 08:46:40 | 2026-07-16 12:54:30 |

All three were published by npm account `ada8877` (contact `k3mlol@proton.mail`) within a **52-second burst** on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC - an exposure window of about **4 hours**. The extreme version numbers (`16.0.0`, `14.8.68`, `1.9.45`) fit the classic dependency-confusion pattern: pick a version higher than any plausible internal semver so a misconfigured resolver picks the public tarball over the private one.

### The `verify.js` reconnaissance payload

Each package ships a `preinstall` hook that:

1. Installs `@sentry/node` as a runtime dependency at install time.
2. Executes `examples/verify.js`, which queries `https://1.1.1.1/cdn-cgi/trace` with spoofed Chrome / Safari / Firefox User-Agent headers to extract the victim's public egress IP without any explicit "am I behind a proxy" tell.
3. Collects host telemetry - hostname, OS username, runtime engine (Node.js version + platform), env-var sample.
4. Beacons the composite record to the attacker-controlled Sentry project `4511744089718784` at `o4510485815754752.ingest.us.sentry.io`, using the standard Sentry DSN transport.

Each of the three package names reports to a distinct Sentry project id inside the same attacker Sentry organization, so the operator can distinguish which package name the misconfigured resolver actually picked. This is a **reconnaissance beacon**, not a full credential stealer - its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier `click2ai-*` reconnaissance packages (Socket / Microsoft tracked a related dep-confusion campaign against nine organizational scopes in May 2026; the payload lineage matches).

### Why the `syft-acp-*` names

The name pattern - `syft-<company>-<generic-slug>` - points at an internal scope belonging to a specific enterprise. `Syft` is either the Anchore SBOM tool (in which case `acp` is likely an unrelated slug), or the internal branding of a UK-based fintech that operates a private `syft-acp-*` npm scope. The trio was published together to maximize the chance of any single misconfigured resolver leaking; version numbers were chosen to look plausible (14.8.68 is close enough to a real 14.x monorepo counter to pass a version-check without human eyes).

## Cluster 2 - @edgecommons preinstall-hook pair (2 packages)

| Package | Ecosystem | Retired (UTC) |
|---|---|---|
| `@edgecommons/streamlog-node` | npm | 2026-07-18 |
| `@edgecommons/edgecommons` | npm | 2026-07-18 |

Both packages were fully unpublished from npm (no `0.0.1-security` replacement tarball remains). GHSA-4rqf-6883-f59f and GHSA-8p39-h6xv-p2g9 confirm a `preinstall` hook that executes on `npm install`, collects host telemetry, and beacons to an attacker-controlled endpoint. The `@edgecommons` scope shape (organization name + generic infra slug like `streamlog-node`) matches the same dependency-confusion pattern the click2ai trio uses.

## Cluster 3 - axios typosquats (2 packages)

| Package | Security replacement (UTC) |
|---|---|
| `axios-native` | 2026-07-17 23:08:05 |
| `telemetry-axios` | 2026-07-17 23:08:10 |

Both packages were npm-security-replaced within a **5-second window** at 2026-07-17 23:08 UTC (23:08:02 → 23:08:10 UTC). Neither has a legitimate first-party parent - they exploit the fame of the `axios` HTTP client library, one of the top-10 most-downloaded npm packages. Original version tarballs are no longer resolvable on the public registry, so the GHSA "all versions" affected range makes no distinction. Any lockfile pin against either name indicates historical install; the fixed replacement is the canonical `axios` package.

## Cluster 4 - `easyway2` 12-version 4-hour burst (1 package)

| Package | Versions | Publish window (UTC) | npm unpublish (UTC) |
|---|---|---|---|
| `easyway2` | `1.0.0` → `1.0.11` (12 versions) | 2026-07-17 11:42 → 14:31 | 2026-07-17 16:31 |

GHSA-68c2-54w2-m326 flags `1.0.3` and `1.0.7` specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic. The full 12-version burst in a 2-hour window suggests dep-confusion race iteration - the operator was rapidly patching the tarball to survive a specific resolver behavior. All 12 versions were npm-unpublished at 2026-07-17 16:31 UTC, about **2 hours after the final version pushed** - an unusually fast take-down.

## Registry state

The `syft-acp-*` trio, `@edgecommons/*` pair, and `easyway2` were all **fully unpublished** from npm (no security-replacement tarball). The `axios-native` + `telemetry-axios` pair received the standard `0.0.1-security` replacement. In both cases, private registry mirrors that cached the tarballs during the publish window WILL keep serving the malicious versions after the public yank - any lockfile hit must be treated as active malware regardless of what the public registry currently returns.

## Impact

- Any host that installed any of the 8 packages below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists
- **click2ai dependency-confusion reconnaissance trio** (3 packages): `syft-acp-core@16.0.0`, `syft-acp-uikit@1.9.45`, `syft-acp-atoms@14.8.68` were all published by npm account `ada8877` (contact `k3mlol@proton.mail`) within a 52-second burst on 2026-07-16 08:45:48 → 08:46:40 UTC, then npm-unpublished the same day at 12:54 UTC (about 4 hours after publish). The extreme version numbers (`16.0.0`, `14.8.68`, `1.9.45`) are classic dep-confusion pins designed to beat the semver of a target org's internal `syft-acp-*` scope - the naming pattern points at a specific enterprise scope resolver misconfiguration. A `preinstall` hook installs `@sentry/node` at install time and runs `examples/verify.js`, which spoofs a browser User-Agent, queries Cloudflare's `1.1.1.1/cdn-cgi/trace` to leak the victim's public egress IP, then beacons hostname + OS username + runtime metadata to the attacker-controlled Sentry project `4511744089718784` at `o4510485815754752.ingest.us.sentry.io`. Each of the three per-namespace beacons reports to a distinct Sentry project id so the operator can tell which of the three package names actually resolved on a victim host - this is a **reconnaissance beacon**, not a full RCE payload, and its purpose is to catalog which organizations have the misconfigured resolver so a follow-on second-stage package can be delivered to a targeted subset. Byte-for-byte payload reuse links the campaign to the earlier `click2ai-*` reconnaissance packages
- **@edgecommons preinstall-hook pair** (2 packages): `@edgecommons/streamlog-node` and `@edgecommons/edgecommons` - both fully unpublished from npm (no security replacement tarball remains), retired via GHSA on 2026-07-18. GHSA records confirm a `preinstall` hook that collects host telemetry and beacons to an attacker-controlled endpoint. The `@edgecommons` scope shape (organization name + generic infra slug like `streamlog-node`) matches the same dependency-confusion pattern the click2ai trio uses
- **axios typosquats** (2 packages): `axios-native@1.0.0` and `telemetry-axios@1.0.0` were both republished as `0.0.1-security` npm-security tarballs at 2026-07-17 23:08 UTC in the same 5-second window (23:08:02 → 23:08:10 UTC). Neither package has a legitimate first-party parent - they exploit the fame of the `axios` HTTP library. GHSA classifies both as full-compromise CWE-506 malware; original version tarballs are no longer resolvable but any lockfile pin against these names indicates historical install
- **`easyway2` singleton** (1 package): 12 versions `1.0.0` → `1.0.11` published in a **4-hour burst on 2026-07-17 11:42 → 14:31 UTC**, then npm-unpublished the same day at 16:31 UTC (roughly 2 hours after the final version pushed). GHSA advisory GHSA-68c2-54w2-m326 flags 1.0.3 and 1.0.7 specifically as OpenSSF-Package-Analysis-tagged for outbound C2 traffic; the sibling versions in the burst all share the same tarball fingerprint per the OpenSSF Package Analysis dataset and should be treated as equally malicious
- None of the 8 packages have surviving version tarballs on the public npm registry - either fully unpublished within hours of first publish, or replaced with `0.0.1-security` sentinel tarballs. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached the tarballs during the 4-hour publish window WILL keep serving the malicious versions after the public yank - lockfile hits on these names must be treated as active malware regardless of what the public registry currently returns

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **If you had `syft-acp-core`, `syft-acp-uikit`, or `syft-acp-atoms` in a lockfile**: this indicates a **misconfigured internal-registry resolver** - the names suggest your organization has (or once had) a private `syft-acp-*` scope on an internal Verdaccio / Artifactory. Audit the resolver order in `.npmrc` (private registry MUST be listed before the public registry for internal-scope names), register defensive stubs on the public npm registry for every internal package name you care about (`npm publish` empty packages under those exact names to prevent future dep-confusion), and consider migrating internal `syft-acp-*` names to a scoped namespace (`@yourorg/*`) with `.npmrc` scope-registry routing so the public registry is never queried for these names
3. **Also for the `syft-acp-*` trio**: audit outbound network traffic during the 2026-07-16 08:45 → 12:54 UTC window for POST requests to `o4510485815754752.ingest.us.sentry.io` - any hit indicates a successful reconnaissance beacon and the affected host is on the operator's follow-on target list. Rotate every credential the affected host could reach, particularly any internal-service credentials that a `preinstall` hook could enumerate via environment variable inspection
4. **If you had `@edgecommons/streamlog-node` or `@edgecommons/edgecommons` in a lockfile**: these have no legitimate first-party parent on npm. The `@edgecommons` scope shape strongly suggests a dependency-confusion pin against an internal `@edgecommons/*` scope; register defensive stubs on the public registry and configure `.npmrc` scope-registry routing to force `@edgecommons/*` resolution through your internal mirror only
5. **If you had `axios-native` or `telemetry-axios` in a lockfile**: these are pure `axios`-brand typosquats with no legitimate parent. Replace with the canonical `axios` package, remove the malicious dependencies, and rotate every credential the CI environment could reach - the `postinstall` execution path reaches cloud metadata, secrets stores, and environment variables loaded by the runner
6. **If you had `easyway2` in a lockfile**: any of the 12 versions `1.0.0` → `1.0.11` should be treated as compromised. Grep for all 12 pins individually - a lockfile that resolved to `1.0.5` (for example) is just as compromised as one that resolved to `1.0.7`, since the tarballs share the OpenSSF-flagged outbound-C2 fingerprint
7. Verify none of the 8 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank
8. For projects using `postinstall`-scripting packages, consider running `npm install --ignore-scripts` in CI as a defense-in-depth measure and re-invoking scripts only for vetted first-party packages

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-289v-6j56-44w8 - syft-acp-core malware advisory](https://github.com/advisories/GHSA-289v-6j56-44w8) - GitHub
- [GHSA-rvgp-458h-wjc3 - syft-acp-uikit malware advisory](https://github.com/advisories/GHSA-rvgp-458h-wjc3) - GitHub
- [GHSA-j5f4-f3f3-634h - syft-acp-atoms malware advisory](https://github.com/advisories/GHSA-j5f4-f3f3-634h) - GitHub
- [GHSA-4rqf-6883-f59f - @edgecommons/streamlog-node malware advisory](https://github.com/advisories/GHSA-4rqf-6883-f59f) - GitHub
- [GHSA-8p39-h6xv-p2g9 - @edgecommons/edgecommons malware advisory](https://github.com/advisories/GHSA-8p39-h6xv-p2g9) - GitHub
- [GHSA-9j78-5mc3-56h7 - axios-native malware advisory](https://github.com/advisories/GHSA-9j78-5mc3-56h7) - GitHub
- [GHSA-89mf-39r2-ff96 - telemetry-axios malware advisory](https://github.com/advisories/GHSA-89mf-39r2-ff96) - GitHub
- [GHSA-68c2-54w2-m326 - easyway2 malware advisory](https://github.com/advisories/GHSA-68c2-54w2-m326) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-18-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-18-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).