DependencyWatch.io
FeedRecommendationsSolutionsSubmitScan your lockfile
Feed
CriticalPublished 28 Jul 202654 packages · 125 versions

GitHub Advisory npm CWE-506 mega-sweep — 54-package sample from the 2026-07-27 → 2026-07-28 batch (8-package Ethereum-tooling `curl|bash` typosquat cluster, chalk / express / prettier / prisma / dotenv / chai-as-promised typosquat pairs, "helper/utils/tool/pack" credential+wallet-stealer family, 13-package dep-confusion cluster with `999.x` / `19999.x` / `99.99.99` version-inflation, Shai-Hulud-style preinstall Bun stealer resurgence, `@vaultflow/*` 2026-07-28 pair, `claude-code-base-action` Anthropic typosquat)

Summary

GitHub Advisory Database published a mega-batch of 250+ new npm CWE-506 malware advisories on 2026-07-27 (spanning 12+ paginated result pages), plus 2 more on 2026-07-28 (@vaultflow/create-flow, @vaultflow/update-flow). This module catalogues 54 non-@antv non-previously-tracked packages from the batch. Notable clusters: 8-package Ethereum-tooling curl|bash operator (web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core), typosquat pairs (chalk-*, exxpress-*, prettier-lint-lenz, prisma-callback, env-threads), dep-confusion with inflated version numbers (999.x, 19999.x, 99.99.99), and Shai-Hulud-style preinstall Bun credential stealers on mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, boring-avatars-vanilla, jest-canvas-mock, @cap-js/openapi.

typosquatcrypto-wallet-draincredential-theftdependency-confusioninfostealerwormci-cd-compromiseobfuscation
Detected by
GitHub Advisory Database · npm Security
Also known as
2026-07-27 GHSA npm mega-sweep · Ethereum-tooling curl|bash cluster · helper/utils/tool/pack typosquat kit · Shai-Hulud AntV-adjacent resurgence
Ecosystems
npm
Packages tracked
54

What happened

On 2026-07-27 and 2026-07-28, the GitHub Advisory Database published a mega-batch of new npm CWE-506 (Embedded Malicious Code) advisories — 250+ advisories on 2026-07-27 alone (spanning 12+ paginated result pages) plus 2 more on 2026-07-28 (@vaultflow/create-flow, @vaultflow/update-flow). The batch shape strongly suggests a coordinated backfill of longstanding malware carried out on the back of an upstream signal — likely OpenSSF Package Analysis feeding into GHSA in bulk, or npm-security scheduling a queue of packages that had accumulated triage-flags.

This module catalogues 54 packages from the batch — the non-@antv/* and non-previously-tracked advisories with confirmed affected versions. The balance of the 250+ batch is dominated by GHSA backfill of the pre-existing @antv/* Mini Shai-Hulud incident (npm-2026-05-19-antv-mini-shai-hulud, 261 packages already tracked) — those advisories are cross-referenced from the AntV module which has been bumped to lastUpdated: 2026-07-28 for this ingest.

Cluster 1 — Ethereum-tooling curl|bash typosquat operator (8 packages)

| Package | Versions | Target | |---|---|---| | web3-core-js | 1.0.0, 2.0.0 | web3.js (Web3 library) | | truffle-js | 1.0.0, 2.0.0 | truffle (dev framework) | | truffle-helper | 1.0.0, 2.0.0 | truffle | | solc-helper | 1.0.0, 2.0.0 | solc (Solidity compiler) | | hardhat-core | (≥1.0.0) | hardhat (dev environment) | | ethers-common | 1.0.0, 2.0.0 | ethers.js (Ethereum JS SDK) | | ethers-io | 1.0.0, 2.0.0 | ethers.js | | cdp-core | 1.0.4, 1.0.6 | Coinbase @coinbase/cdp-sdk |

All eight run near-identical postinstall hooks: base64-decode a URL, curl it over plain HTTP, pipe the response to bash. The identical 1.0.0 / 2.0.0 two-version publish signature on 7 of the 8 (plus cdp-core on a different version pattern) is a strong operator-overlap signal.

Cluster 2 — "helper/utils/tool/pack" credential+wallet stealer family (10 packages)

| Package | Versions | Target | |---|---|---| | chalk-pack | 1.0.4, 2.0.0 | chalk | | chalk-utils | 1.0.3, 1.0.4, 2.0.0 | chalk | | exxpress-utils | 1.0.2, 1.0.3, 1.0.5, 2.0.0 | express (double-x typo) | | exxpress-tool | 1.0.0, 1.0.2, 1.0.5 | express | | dotenvv-tool | 1.0.2–2.0.0 | dotenv (double-v typo) | | joi-pack | 1.0.3, 1.0.4, 1.0.5 | joi | | nock-helper | 1.0.2–2.0.0 | nock | | cheerio-tool | 1.0.3, 1.0.4, 1.0.5 | cheerio | | glob-helper | 1.0.0–2.0.0 | glob | | rimraf-utils | 1.0.4, 1.0.5, 2.0.0 | rimraf |

All ten use the same "helper/utils/tool/pack" suffix convention on a well-known dependency name and share an identical postinstall payload that reads ~/.npmrc, ~/.env, ~/.git-credentials, and every browser wallet-extension's storage directory, POSTing the harvested material to a static C2 endpoint. Very likely a single operator using an automated typosquat kit.

Cluster 3 — Shai-Hulud-style preinstall Bun credential stealer resurgence (8 packages)

| Package | Versions | Notes | |---|---|---| | boring-avatars-vanilla | 1.1.2, 1.2.2 | boring-avatars typosquat | | jest-canvas-mock | 2.5.3, 2.6.3, 2.7.3 | canonical jest-canvas-mock hijack — dep-name reuse | | mcp-echarts | 0.8.1, 0.9.1 | AntV-family MCP server | | mcp-mermaid | 0.5.1, 0.6.1 | AntV-family MCP server | | ai-figure | 0.5.0, 0.6.0 | AntV-adjacent | | gantt-for-react | 0.3.0, 0.4.0 | AntV-adjacent | | amapcn | (≤0.2.2 and ≤0.3.2) | AMap (AntV/Alipay family) | | @cap-js/openapi | 1.4.1 | SAP CAP-JS — same scope as 2026-04 npm-2026-04-sap-cap-js |

All eight use the same ~498KB obfuscated Bun-runtime preinstall payload previously documented in the 2026-05-11 TanStack + Mini Shai-Hulud campaign and the 2026-05-19 AntV wave. Behaviours: AWS IMDSv2 + GCP metadata + Azure managed identity scrape, Kubernetes SA-token theft, HashiCorp Vault reads, npm/GitHub token exfil via GitHub API, then CI/CD workflow injection for persistence.

The AntV-adjacent hits and the @cap-js/openapi addition strongly suggest GHSA is backfilling packages that were part of the same worm-family activity but missed in the original triage. Treat these as critical, same-worm-family exposure.

Cluster 4 — dep-confusion via inflated version numbers (13 packages)

| Package | Version | Notes | |---|---|---| | @webapp-next/store | 91.1.0 | scoped internal-name | | @design-system-coopeuch/web | 999.0.0, 999.0.4 | 999.x major | | @pelmnaads/naads-common-logger | 19999.0.1 | 5-digit major | | bui-react-10components | 99.0.0 | 99.x major | | @datatrain/passenger-v3 | 99.99.99 | classic 99.99.99 dep-confusion | | identitysecuretokenserv | 10.0.0, 20.0.0 | non-scoped internal-lib name | | paysafe-gbp-virtual-assistant-lib-fe | 2.0.4 | Paysafe internal-lib (see multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat) | | @convera/ui-shared | 0.0.2, 0.0.3 | scoped internal-name (Convera fintech) | | @apps-home-dashboard/events | (≤11.9.1) | scoped internal-name | | apex-trading | 1.0.4 | trading-platform impersonation | | apex-connector | (≤1.0.4) | trading-platform impersonation | | @tc-core/campus-service | 0.0.0-defensive-callback | prerelease-tag "defensive-callback" — probable research-tooling probe | | @citi-icg-158830/elemental-chameleon | 0.0.0-defensive-callback, .1 | Citi ICG scope with defensive-callback tag — probable research probe |

The 0.0.0-defensive-callback prerelease-tag naming on the @tc-core/* and @citi-icg-158830/* entries is distinctive. It reads as an automated dep-confusion probe kit (Snyk's Fetch service, CodeSec's Chain-Bench, or a similar researcher-owned tool) that GHSA is flagging out of caution. The other 11 entries in this cluster are classical attacker-controlled dep-confusion.

Cluster 5 — misc typosquats and RATs (12 packages)

| Package | Versions | Notes | |---|---|---| | sysbin | 1.0.34 | clipboard + screenshot exfil Python stager | | vue-template-compiler-plugin | 2.7.18 | full RAT with C2 beacon | | typography-stylecss | 0.7.4 | @tailwindcss/typography typosquat, binary dropper | | env-threads | 1.5.0 | dotenv typosquat, steganographic JPEG payload | | chai-as-regulated | (≤2.0.12) | chai-as-promised typosquat, silent bg process | | prettier-lint-lenz | 1.0.0, 2.6.4 | prettier typosquat, clipboard-stealing trojan | | prisma-callback | 1.0.0, 1.0.3–1.0.5 | prisma typosquat, opaque compiled binary | | hello-world-pkg-value-value-p | 1.0.4, 1.0.11 | reverse shell → 52.249.218.132:8080 (Azure IP) | | request-logger-canary | 1.0.0 | reverse shell on install | | cache-poisoning-pwn-demo | 0.1.27–0.1.29 | explicit PoC dropping calc.exe | | node-ci-utils | (≤2.1.4) | opaque binary downloader | | motion-forge-css | (all versions) | embedded malicious code | | claude-code-base-action | 2.0.0, 2.2.2 | typosquat of anthropics/claude-code-base-action GitHub Action |

2026-07-28 — @vaultflow/* pair

| Package | Versions | Notes | |---|---|---| | @vaultflow/update-flow | (all versions) | HashiCorp Vault tooling scope, secret/key stealer | | @vaultflow/create-flow | (all versions) | HashiCorp Vault tooling scope, secret/key stealer |

Coordinated same-scope publish on 2026-07-28 (the only two 2026-07-28-dated advisories in the batch). Both flagged as >=0 all-versions in the advisory range.

Registry state

All 54 packages security-replaced with 0.0.1-security sentinel tarballs. Original version tarballs are no longer resolvable on the public registry, but private registry mirrors that cached the tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

  • The pre-existing npm-2026-05-19-antv-mini-shai-hulud module (261 packages) covers the bulk of the 2026-07-27 batch's @antv/* backfill and has been bumped on this ingest.
  • @cap-js/openapi extends the SAP CAP-JS attack surface previously documented in npm-2026-04-sap-cap-js and npm-2026-05-shai-hulud-tanstack (which also covers @cap-js/*).
  • paysafe-gbp-virtual-assistant-lib-fe extends the Paysafe-internal-lib impersonation campaign in multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat.
  • The Ethereum-tooling curl|bash cluster (Cluster 1) is a fresh operator not previously catalogued.

Affected packages (54)

  • npm@apps-home-dashboard/events
    11.9.011.9.1
  • npm@cap-js/openapi
    1.4.1
  • npm@citi-icg-158830/elemental-chameleon
    0.0.0-defensive-callback0.0.0-defensive-callback.1
  • npm@convera/ui-shared
    0.0.20.0.3
  • npm@datatrain/passenger-v3
    99.99.99
  • npm@design-system-coopeuch/web
    999.0.0999.0.4
  • npm@pelmnaads/naads-common-logger
    19999.0.1
  • npm@tc-core/campus-service
    0.0.0-defensive-callback
  • npm@vaultflow/create-flow
    1.0.0
  • npm@vaultflow/update-flow
    1.0.0
  • npm@webapp-next/store
    91.1.0
  • npmai-figure
    0.5.00.6.0
  • npmamapcn
    0.2.00.2.10.2.20.3.00.3.10.3.2
  • npmapex-connector
    1.0.01.0.11.0.21.0.31.0.4
  • npmapex-trading
    1.0.4
  • npmboring-avatars-vanilla
    1.1.21.2.2
  • npmbui-react-10components
    99.0.0
  • npmcache-poisoning-pwn-demo
    0.1.270.1.280.1.29
  • npmcdp-core
    1.0.41.0.6
  • npmchai-as-regulated
    2.0.102.0.112.0.12
  • npmchalk-pack
    1.0.42.0.0
  • npmchalk-utils
    1.0.31.0.42.0.0
  • npmcheerio-tool
    1.0.31.0.41.0.5
  • npmclaude-code-base-action
    2.0.02.2.2
  • npmdotenvv-tool
    1.0.21.0.31.0.41.0.52.0.0
  • npmenv-threads
    1.5.0
  • npmethers-common
    1.0.02.0.0
  • npmethers-io
    1.0.02.0.0
  • npmexxpress-tool
    1.0.01.0.21.0.5
  • npmexxpress-utils
    1.0.21.0.31.0.52.0.0
  • npmgantt-for-react
    0.3.00.4.0
  • npmglob-helper
    1.0.01.0.11.0.21.0.31.0.41.0.52.0.0
  • npmhardhat-core
    1.0.02.0.0
  • npmhello-world-pkg-value-value-p
    1.0.41.0.11
  • npmidentitysecuretokenserv
    10.0.020.0.0
  • npmjest-canvas-mock
    2.5.32.6.32.7.3
  • npmjoi-pack
    1.0.31.0.41.0.5
  • npmmcp-echarts
    0.8.10.9.1
  • npmmcp-mermaid
    0.5.10.6.1
  • npmmotion-forge-css
    1.0.0
  • npmnock-helper
    1.0.21.0.31.0.41.0.52.0.0
  • npmnode-ci-utils
    2.1.02.1.12.1.22.1.32.1.4
  • npmpaysafe-gbp-virtual-assistant-lib-fe
    2.0.4
  • npmprettier-lint-lenz
    1.0.02.6.4
  • npmprisma-callback
    1.0.01.0.31.0.41.0.5
  • npmrequest-logger-canary
    1.0.0
  • npmrimraf-utils
    1.0.41.0.52.0.0
  • npmsolc-helper
    1.0.02.0.0
  • npmsysbin
    1.0.34
  • npmtruffle-helper
    1.0.02.0.0
  • npmtruffle-js
    1.0.02.0.0
  • npmtypography-stylecss
    0.7.4
  • npmvue-template-compiler-plugin
    2.7.18
  • npmweb3-core-js
    1.0.02.0.0

Impact

  • Any host that installed any of the 54 packages listed below should be treated as fully compromised — every GHSA record uses the boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised — rotate all secrets from a different computer" language, and no patched version exists
  • Cluster 1 — Ethereum-tooling curl|bash typosquat operator (8 packages, all published 2026-07-27 with the identical 1.0.0 / 2.0.0 two-version signature except cdp-core): web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core. All eight run near-identical postinstall lifecycle hooks that base64-decode a URL, curl it over plain HTTP, and pipe the response to bash — a classic stager pattern. Each name typosquats a household Ethereum tool: web3.js (Web3 library), truffle (dev framework), solc (Solidity compiler), hardhat (dev environment), ethers.js (Ethereum JS SDK), Coinbase @coinbase/cdp-sdk (CDP-Core wallet SDK). Operator overlap near-certain: same TTP, same publish date, same version pattern
  • Cluster 2 — "helper/utils/tool/pack" credential+wallet stealer family (10 packages, same postinstall signature reading ~/.npmrc, ~/.env, ~/.git-credentials, plus browser wallet-extension directories): chalk-pack, chalk-utils (chalk typosquat pair), exxpress-utils, exxpress-tool (express typosquat pair — double-x), dotenvv-tool (dotenv typosquat), joi-pack (joi typosquat), nock-helper (nock typosquat), cheerio-tool (cheerio typosquat), glob-helper (glob typosquat), rimraf-utils (rimraf typosquat). All ten use the same "helper/utils/tool/pack" suffix convention on a well-known dependency name — very likely a single operator using an automated typosquat kit
  • Cluster 3 — Shai-Hulud-style preinstall Bun credential stealer resurgence (8 packages): boring-avatars-vanilla, jest-canvas-mock, mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, @cap-js/openapi. All use the same ~498KB obfuscated Bun-runtime preinstall payload documented in the 2026-05-11 TanStack + Mini Shai-Hulud campaign (npm-2026-05-shai-hulud-tanstack) and the 2026-05-19 AntV wave (npm-2026-05-19-antv-mini-shai-hulud): AWS IMDSv2 + GCP metadata + Azure managed identity scrape, Kubernetes SA-token theft, HashiCorp Vault reads, npm/GitHub token exfil via GitHub API, then CI/CD workflow injection for persistence. The AntV-adjacent hits (mcp-echarts, mcp-mermaid — visualisation MCP servers; ai-figure, gantt-for-react, amapcn — AMap is part of the AntV/Alipay ecosystem) and @cap-js/openapi (SAP CAP-JS scope, matching the 2026-04 npm-2026-04-sap-cap-js incident) strongly suggest GHSA is backfilling packages missed in the original triage — treat these as critical, same-worm-family exposure
  • Cluster 4 — dep-confusion via inflated version numbers (13 packages, all target internal-scope names with absurdly-high semver): @webapp-next/store@91.1.0, @design-system-coopeuch/web@999.0.0/999.0.4, @pelmnaads/naads-common-logger@19999.0.1 (a five-digit major version), bui-react-10components@99.0.0, @datatrain/passenger-v3@99.99.99, identitysecuretokenserv@10.0.0/20.0.0, paysafe-gbp-virtual-assistant-lib-fe@2.0.4 (Paysafe internal-lib impersonation matching multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat), @convera/ui-shared@0.0.2/0.0.3, @apps-home-dashboard/events (≤11.9.1), apex-trading@1.0.4, apex-connector (≤1.0.4), @tc-core/campus-service@0.0.0-defensive-callback, @citi-icg-158830/elemental-chameleon@0.0.0-defensive-callback/.1. The 0.0.0-defensive-callback prerelease-tag naming on @tc-core/* and @citi-icg-158830/* looks like an automated dep-confusion probe kit — likely Snyk/CodeSec research tooling that GHSA is flagging out of caution
  • Cluster 5 — misc typosquats and RATs: sysbin@1.0.34 (clipboard + screenshot exfiltration Python stager), vue-template-compiler-plugin@2.7.18 (full RAT with C2 beacon), typography-stylecss@0.7.4 (@tailwindcss/typography typosquat, binary dropper), env-threads@1.5.0 (dotenv typosquat with steganographic JPEG payload), chai-as-regulated (≤2.0.12) (chai-as-promised typosquat, silent bg process), prettier-lint-lenz@1.0.0/2.6.4 (prettier typosquat, clipboard-stealing trojan), prisma-callback@1.0.0/1.0.3–1.0.5 (prisma typosquat, opaque compiled binary), hello-world-pkg-value-value-p@1.0.4/1.0.11 (reverse shell → 52.249.218.132:8080), request-logger-canary@1.0.0 (reverse shell on install), cache-poisoning-pwn-demo@0.1.27–0.1.29 (explicit PoC dropping calc.exe), node-ci-utils (≤2.1.4) (opaque binary downloader), motion-forge-css (all versions), claude-code-base-action@2.0.0/2.2.2 (typosquat of anthropics/claude-code-base-action GitHub Action — a supply-chain angle on Anthropic's official CLI Action)
  • *2026-07-28 — `@vaultflow/ pair**: @vaultflow/update-flow, @vaultflow/create-flow — a coordinated same-scope publish targeting HashiCorp Vault workflow tooling; both flagged as >=0` (all-versions) secret-stealers on the day of ingest
  • None of the 54 packages have surviving version tarballs on the public npm registry — all replaced with 0.0.1-security sentinel tarballs during the 2026-07-27 → 2026-07-28 batch. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
  2. 2Highest-priority remediation — Cluster 3 (Shai-Hulud family): any hit on boring-avatars-vanilla, jest-canvas-mock, mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, or @cap-js/openapi at the listed versions requires the full TanStack/AntV Mini Shai-Hulud remediation: rotate npm tokens, GitHub PATs + OIDC trust relationships, AWS IAM keys reachable from build hosts, GCP service-account credentials, Azure managed-identity tokens, Kubernetes service-account tokens, HashiCorp Vault tokens, and every CI/CD secret. Audit .github/workflows/ for injected steps
  3. 3Cluster 1 (Ethereum tooling) — if any of web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core appears in a lockfile: treat as a wallet-compromise event. Rotate every crypto wallet key, seed phrase, and hardware-wallet PIN accessible from the dev host. Move funds via a clean device BEFORE attempting rotation. Verify what the curl|bash stager actually executed by inspecting outbound HTTP logs
  4. 4Cluster 2 (credential+wallet stealer family) — if any of chalk-pack, chalk-utils, exxpress-utils, exxpress-tool, dotenvv-tool, joi-pack, nock-helper, cheerio-tool, glob-helper, rimraf-utils appears: ~/.npmrc, ~/.env, ~/.git-credentials, and every browser wallet extension's storage are considered exfiltrated. Rotate npm tokens, GitHub credentials, every secret in .env, and re-key crypto wallets
  5. 5Cluster 4 (dep-confusion inflated-version) — if any of the 999.x / 19999.x / 99.99.99 / 99.0.0 / 91.1.0 / 10.0.0 / 20.0.0 packages listed appears: you have an INTERNAL package the attacker guessed; configure your registry client to scope-restrict private packages (.npmrc @scope:registry= mapping), then rebuild the lockfile against the private registry. Rotate secrets reachable from build hosts. For the 0.0.0-defensive-callback prerelease-tag entries (@tc-core/campus-service, @citi-icg-158830/elemental-chameleon), the naming looks like a research-tooling artefact — investigate whether the hit represents a Snyk/CodeSec probe or a live compromise
  6. 6paysafe-gbp-virtual-assistant-lib-fe@2.0.4 — cross-reference with multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat; this is the same Paysafe-internal-lib impersonation campaign continuing three weeks later. If any paysafe-* name appears, rotate every Paysafe/Skrill integration credential and audit build-host activity
  7. 7claude-code-base-action@2.0.0/2.2.2 — this typosquats the legitimate anthropics/claude-code-base-action GitHub Action. Any .github/workflows/*.yml file referencing uses: <someone-else>/claude-code-base-action@ is compromised; the canonical action is uses: anthropics/claude-code-base-action@v1 (or a specific released tag)
  8. 8*`@vaultflow/` (2026-07-28)** — treat as HashiCorp Vault credential exfiltration. Rotate every Vault token, root token, and audit-log-visible client identity that could have been reachable
  9. 9For projects using postinstall-scripting packages, run npm install --ignore-scripts in CI as defense-in-depth and invoke scripts only for vetted first-party packages
  10. 10Verify none of the 54 listed packages still resolves via your private mirror — internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank
  11. 11Broader batch context: the 2026-07-27 GitHub Advisory Database batch spans 250+ CWE-506 advisories (12+ pages of paginated results, all dated 2026-07-27). This module catalogues 54; the balance is dominated by GHSA backfill of the pre-existing @antv/* Mini Shai-Hulud incident (npm-2026-05-19-antv-mini-shai-hulud, published 2026-05-19), which has been updated on this ingest to reflect the ongoing formal-advisory cataloguing of packages already tracked in its 261-package map

References

Back to feedSubmit a correction
npm-2026-07-28-ghsa-malware-sweep