DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighAdvisory sweepPublished 28 Jul 202654 packages · 125 versions

GitHub Advisory npm CWE-506 mega-sweep - 54-package sample from the 2026-07-27 → 2026-07-28 batch (8-package Ethereum-tooling `curl|bash` typosquat cluster, chalk / express / prettier / prisma / dotenv / chai-as-promised typosquat pairs, "helper/utils/tool/pack" credential+wallet-stealer family, 13-package dep-confusion cluster with `999.x` / `19999.x` / `99.99.99` version-inflation, Shai-Hulud-style preinstall Bun stealer resurgence, `@vaultflow/*` 2026-07-28 pair, `claude-code-base-action` Anthropic typosquat)

Summary

GitHub Advisory Database published a mega-batch of 250+ new npm CWE-506 malware advisories on 2026-07-27 (spanning 12+ paginated result pages), plus 2 more on 2026-07-28 (@vaultflow/create-flow, @vaultflow/update-flow). This module catalogues 54 non-@antv non-previously-tracked packages from the batch. Notable clusters: 8-package Ethereum-tooling curl|bash operator (web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core), typosquat pairs (chalk-*, exxpress-*, prettier-lint-lenz, prisma-callback, env-threads), dep-confusion with inflated version numbers (999.x, 19999.x, 99.99.99), and Shai-Hulud-style preinstall Bun credential stealers on mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, boring-avatars-vanilla, jest-canvas-mock, @cap-js/openapi.

typosquatcrypto-wallet-draincredential-theftdependency-confusioninfostealerwormci-cd-compromiseobfuscation
Incident type
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
Detected by
GitHub Advisory Database · npm Security
Also known as
2026-07-27 GHSA npm mega-sweep · Ethereum-tooling curl|bash cluster · helper/utils/tool/pack typosquat kit · Shai-Hulud AntV-adjacent resurgence
Ecosystems
npm
Packages tracked
54

What happened

On 2026-07-27 and 2026-07-28, the GitHub Advisory Database published a mega-batch of new npm CWE-506 (Embedded Malicious Code) advisories - 250+ advisories on 2026-07-27 alone (spanning 12+ paginated result pages) plus 2 more on 2026-07-28 (@vaultflow/create-flow, @vaultflow/update-flow). The batch shape strongly suggests a coordinated backfill of longstanding malware carried out on the back of an upstream signal - likely OpenSSF Package Analysis feeding into GHSA in bulk, or npm-security scheduling a queue of packages that had accumulated triage-flags.

This module catalogues 54 packages from the batch - the non-@antv/* and non-previously-tracked advisories with confirmed affected versions. The balance of the 250+ batch is dominated by GHSA backfill of the pre-existing @antv/* Mini Shai-Hulud incident (npm-2026-05-19-antv-mini-shai-hulud, 261 packages already tracked) - those advisories are cross-referenced from the AntV module which has been bumped to lastUpdated: 2026-07-28 for this ingest.

Cluster 1 - Ethereum-tooling curl|bash typosquat operator (8 packages)

PackageVersionsTarget
web3-core-js1.0.0, 2.0.0web3.js (Web3 library)
truffle-js1.0.0, 2.0.0truffle (dev framework)
truffle-helper1.0.0, 2.0.0truffle
solc-helper1.0.0, 2.0.0solc (Solidity compiler)
hardhat-core(≥1.0.0)hardhat (dev environment)
ethers-common1.0.0, 2.0.0ethers.js (Ethereum JS SDK)
ethers-io1.0.0, 2.0.0ethers.js
cdp-core1.0.4, 1.0.6Coinbase @coinbase/cdp-sdk

All eight run near-identical postinstall hooks: base64-decode a URL, curl it over plain HTTP, pipe the response to bash. The identical 1.0.0 / 2.0.0 two-version publish signature on 7 of the 8 (plus cdp-core on a different version pattern) is a strong operator-overlap signal.

Cluster 2 - "helper/utils/tool/pack" credential+wallet stealer family (10 packages)

PackageVersionsTarget
chalk-pack1.0.4, 2.0.0chalk
chalk-utils1.0.3, 1.0.4, 2.0.0chalk
exxpress-utils1.0.2, 1.0.3, 1.0.5, 2.0.0express (double-x typo)
exxpress-tool1.0.0, 1.0.2, 1.0.5express
dotenvv-tool1.0.2–2.0.0dotenv (double-v typo)
joi-pack1.0.3, 1.0.4, 1.0.5joi
nock-helper1.0.2–2.0.0nock
cheerio-tool1.0.3, 1.0.4, 1.0.5cheerio
glob-helper1.0.0–2.0.0glob
rimraf-utils1.0.4, 1.0.5, 2.0.0rimraf

All ten use the same "helper/utils/tool/pack" suffix convention on a well-known dependency name and share an identical postinstall payload that reads ~/.npmrc, ~/.env, ~/.git-credentials, and every browser wallet-extension's storage directory, POSTing the harvested material to a static C2 endpoint. Very likely a single operator using an automated typosquat kit.

Cluster 3 - Shai-Hulud-style preinstall Bun credential stealer resurgence (8 packages)

PackageVersionsNotes
boring-avatars-vanilla1.1.2, 1.2.2boring-avatars typosquat
jest-canvas-mock2.5.3, 2.6.3, 2.7.3canonical jest-canvas-mock hijack - dep-name reuse
mcp-echarts0.8.1, 0.9.1AntV-family MCP server
mcp-mermaid0.5.1, 0.6.1AntV-family MCP server
ai-figure0.5.0, 0.6.0AntV-adjacent
gantt-for-react0.3.0, 0.4.0AntV-adjacent
amapcn(≤0.2.2 and ≤0.3.2)AMap (AntV/Alipay family)
@cap-js/openapi1.4.1SAP CAP-JS - same scope as 2026-04 npm-2026-04-sap-cap-js

All eight use the same ~498KB obfuscated Bun-runtime preinstall payload previously documented in the 2026-05-11 TanStack + Mini Shai-Hulud campaign and the 2026-05-19 AntV wave. Behaviours: AWS IMDSv2 + GCP metadata + Azure managed identity scrape, Kubernetes SA-token theft, HashiCorp Vault reads, npm/GitHub token exfil via GitHub API, then CI/CD workflow injection for persistence.

The AntV-adjacent hits and the @cap-js/openapi addition strongly suggest GHSA is backfilling packages that were part of the same worm-family activity but missed in the original triage. Treat these as critical, same-worm-family exposure.

Cluster 4 - dep-confusion via inflated version numbers (13 packages)

PackageVersionNotes
@webapp-next/store91.1.0scoped internal-name
@design-system-coopeuch/web999.0.0, 999.0.4999.x major
@pelmnaads/naads-common-logger19999.0.15-digit major
bui-react-10components99.0.099.x major
@datatrain/passenger-v399.99.99classic 99.99.99 dep-confusion
identitysecuretokenserv10.0.0, 20.0.0non-scoped internal-lib name
paysafe-gbp-virtual-assistant-lib-fe2.0.4Paysafe internal-lib (see multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat)
@convera/ui-shared0.0.2, 0.0.3scoped internal-name (Convera fintech)
@apps-home-dashboard/events(≤11.9.1)scoped internal-name
apex-trading1.0.4trading-platform impersonation
apex-connector(≤1.0.4)trading-platform impersonation
@tc-core/campus-service0.0.0-defensive-callbackprerelease-tag "defensive-callback" - probable research-tooling probe
@citi-icg-158830/elemental-chameleon0.0.0-defensive-callback, .1Citi ICG scope with defensive-callback tag - probable research probe

The 0.0.0-defensive-callback prerelease-tag naming on the @tc-core/* and @citi-icg-158830/* entries is distinctive. It reads as an automated dep-confusion probe kit (Snyk's Fetch service, CodeSec's Chain-Bench, or a similar researcher-owned tool) that GHSA is flagging out of caution. The other 11 entries in this cluster are classical attacker-controlled dep-confusion.

Cluster 5 - misc typosquats and RATs (12 packages)

PackageVersionsNotes
sysbin1.0.34clipboard + screenshot exfil Python stager
vue-template-compiler-plugin2.7.18full RAT with C2 beacon
typography-stylecss0.7.4@tailwindcss/typography typosquat, binary dropper
env-threads1.5.0dotenv typosquat, steganographic JPEG payload
chai-as-regulated(≤2.0.12)chai-as-promised typosquat, silent bg process
prettier-lint-lenz1.0.0, 2.6.4prettier typosquat, clipboard-stealing trojan
prisma-callback1.0.0, 1.0.3–1.0.5prisma typosquat, opaque compiled binary
hello-world-pkg-value-value-p1.0.4, 1.0.11reverse shell → 52.249.218.132:8080 (Azure IP)
request-logger-canary1.0.0reverse shell on install
cache-poisoning-pwn-demo0.1.27–0.1.29explicit PoC dropping calc.exe
node-ci-utils(≤2.1.4)opaque binary downloader
motion-forge-css(all versions)embedded malicious code
claude-code-base-action2.0.0, 2.2.2typosquat of anthropics/claude-code-base-action GitHub Action

2026-07-28 - @vaultflow/* pair

PackageVersionsNotes
@vaultflow/update-flow(all versions)HashiCorp Vault tooling scope, secret/key stealer
@vaultflow/create-flow(all versions)HashiCorp Vault tooling scope, secret/key stealer

Coordinated same-scope publish on 2026-07-28 (the only two 2026-07-28-dated advisories in the batch). Both flagged as >=0 all-versions in the advisory range.

Registry state

All 54 packages security-replaced with 0.0.1-security sentinel tarballs. Original version tarballs are no longer resolvable on the public registry, but private registry mirrors that cached the tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

  • The pre-existing npm-2026-05-19-antv-mini-shai-hulud module (261 packages) covers the bulk of the 2026-07-27 batch's @antv/* backfill and has been bumped on this ingest.
  • @cap-js/openapi extends the SAP CAP-JS attack surface previously documented in npm-2026-04-sap-cap-js and npm-2026-05-shai-hulud-tanstack (which also covers @cap-js/*).
  • paysafe-gbp-virtual-assistant-lib-fe extends the Paysafe-internal-lib impersonation campaign in multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat.
  • The Ethereum-tooling curl|bash cluster (Cluster 1) is a fresh operator not previously catalogued.

Affected packages (54)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Any host that installed any of the 54 packages listed below should be treated as fully compromised - every GHSA record uses the boilerplate CWE-506 "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" language, and no patched version exists
  • Cluster 1 - Ethereum-tooling curl|bash typosquat operator (8 packages, all published 2026-07-27 with the identical 1.0.0 / 2.0.0 two-version signature except cdp-core): web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core. All eight run near-identical postinstall lifecycle hooks that base64-decode a URL, curl it over plain HTTP, and pipe the response to bash - a classic stager pattern. Each name typosquats a household Ethereum tool: web3.js (Web3 library), truffle (dev framework), solc (Solidity compiler), hardhat (dev environment), ethers.js (Ethereum JS SDK), Coinbase @coinbase/cdp-sdk (CDP-Core wallet SDK). Operator overlap near-certain: same TTP, same publish date, same version pattern
  • Cluster 2 - "helper/utils/tool/pack" credential+wallet stealer family (10 packages, same postinstall signature reading ~/.npmrc, ~/.env, ~/.git-credentials, plus browser wallet-extension directories): chalk-pack, chalk-utils (chalk typosquat pair), exxpress-utils, exxpress-tool (express typosquat pair - double-x), dotenvv-tool (dotenv typosquat), joi-pack (joi typosquat), nock-helper (nock typosquat), cheerio-tool (cheerio typosquat), glob-helper (glob typosquat), rimraf-utils (rimraf typosquat). All ten use the same "helper/utils/tool/pack" suffix convention on a well-known dependency name - very likely a single operator using an automated typosquat kit
  • Cluster 3 - Shai-Hulud-style preinstall Bun credential stealer resurgence (8 packages): boring-avatars-vanilla, jest-canvas-mock, mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, @cap-js/openapi. All use the same ~498KB obfuscated Bun-runtime preinstall payload documented in the 2026-05-11 TanStack + Mini Shai-Hulud campaign (npm-2026-05-shai-hulud-tanstack) and the 2026-05-19 AntV wave (npm-2026-05-19-antv-mini-shai-hulud): AWS IMDSv2 + GCP metadata + Azure managed identity scrape, Kubernetes SA-token theft, HashiCorp Vault reads, npm/GitHub token exfil via GitHub API, then CI/CD workflow injection for persistence. The AntV-adjacent hits (mcp-echarts, mcp-mermaid - visualisation MCP servers; ai-figure, gantt-for-react, amapcn - AMap is part of the AntV/Alipay ecosystem) and @cap-js/openapi (SAP CAP-JS scope, matching the 2026-04 npm-2026-04-sap-cap-js incident) strongly suggest GHSA is backfilling packages missed in the original triage - treat these as critical, same-worm-family exposure
  • Cluster 4 - dep-confusion via inflated version numbers (13 packages, all target internal-scope names with absurdly-high semver): @webapp-next/store@91.1.0, @design-system-coopeuch/web@999.0.0/999.0.4, @pelmnaads/naads-common-logger@19999.0.1 (a five-digit major version), bui-react-10components@99.0.0, @datatrain/passenger-v3@99.99.99, identitysecuretokenserv@10.0.0/20.0.0, paysafe-gbp-virtual-assistant-lib-fe@2.0.4 (Paysafe internal-lib impersonation matching multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat), @convera/ui-shared@0.0.2/0.0.3, @apps-home-dashboard/events (≤11.9.1), apex-trading@1.0.4, apex-connector (≤1.0.4), @tc-core/campus-service@0.0.0-defensive-callback, @citi-icg-158830/elemental-chameleon@0.0.0-defensive-callback/.1. The 0.0.0-defensive-callback prerelease-tag naming on @tc-core/* and @citi-icg-158830/* looks like an automated dep-confusion probe kit - likely Snyk/CodeSec research tooling that GHSA is flagging out of caution
  • Cluster 5 - misc typosquats and RATs: sysbin@1.0.34 (clipboard + screenshot exfiltration Python stager), vue-template-compiler-plugin@2.7.18 (full RAT with C2 beacon), typography-stylecss@0.7.4 (@tailwindcss/typography typosquat, binary dropper), env-threads@1.5.0 (dotenv typosquat with steganographic JPEG payload), chai-as-regulated (≤2.0.12) (chai-as-promised typosquat, silent bg process), prettier-lint-lenz@1.0.0/2.6.4 (prettier typosquat, clipboard-stealing trojan), prisma-callback@1.0.0/1.0.3–1.0.5 (prisma typosquat, opaque compiled binary), hello-world-pkg-value-value-p@1.0.4/1.0.11 (reverse shell → 52.249.218.132:8080), request-logger-canary@1.0.0 (reverse shell on install), cache-poisoning-pwn-demo@0.1.27–0.1.29 (explicit PoC dropping calc.exe), node-ci-utils (≤2.1.4) (opaque binary downloader), motion-forge-css (all versions), claude-code-base-action@2.0.0/2.2.2 (typosquat of anthropics/claude-code-base-action GitHub Action - a supply-chain angle on Anthropic's official CLI Action)
  • *2026-07-28 - `@vaultflow/ pair**: @vaultflow/update-flow, @vaultflow/create-flow - a coordinated same-scope publish targeting HashiCorp Vault workflow tooling; both flagged as >=0` (all-versions) secret-stealers on the day of ingest
  • None of the 54 packages have surviving version tarballs on the public npm registry - all replaced with 0.0.1-security sentinel tarballs during the 2026-07-27 → 2026-07-28 batch. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
  2. 2Highest-priority remediation - Cluster 3 (Shai-Hulud family): any hit on boring-avatars-vanilla, jest-canvas-mock, mcp-echarts, mcp-mermaid, ai-figure, gantt-for-react, amapcn, or @cap-js/openapi at the listed versions requires the full TanStack/AntV Mini Shai-Hulud remediation: rotate npm tokens, GitHub PATs + OIDC trust relationships, AWS IAM keys reachable from build hosts, GCP service-account credentials, Azure managed-identity tokens, Kubernetes service-account tokens, HashiCorp Vault tokens, and every CI/CD secret. Audit .github/workflows/ for injected steps
  3. 3Cluster 1 (Ethereum tooling) - if any of web3-core-js, truffle-js, truffle-helper, solc-helper, hardhat-core, ethers-common, ethers-io, cdp-core appears in a lockfile: treat as a wallet-compromise event. Rotate every crypto wallet key, seed phrase, and hardware-wallet PIN accessible from the dev host. Move funds via a clean device BEFORE attempting rotation. Verify what the curl|bash stager actually executed by inspecting outbound HTTP logs
  4. 4Cluster 2 (credential+wallet stealer family) - if any of chalk-pack, chalk-utils, exxpress-utils, exxpress-tool, dotenvv-tool, joi-pack, nock-helper, cheerio-tool, glob-helper, rimraf-utils appears: ~/.npmrc, ~/.env, ~/.git-credentials, and every browser wallet extension's storage are considered exfiltrated. Rotate npm tokens, GitHub credentials, every secret in .env, and re-key crypto wallets
  5. 5Cluster 4 (dep-confusion inflated-version) - if any of the 999.x / 19999.x / 99.99.99 / 99.0.0 / 91.1.0 / 10.0.0 / 20.0.0 packages listed appears: you have an INTERNAL package the attacker guessed; configure your registry client to scope-restrict private packages (.npmrc @scope:registry= mapping), then rebuild the lockfile against the private registry. Rotate secrets reachable from build hosts. For the 0.0.0-defensive-callback prerelease-tag entries (@tc-core/campus-service, @citi-icg-158830/elemental-chameleon), the naming looks like a research-tooling artefact - investigate whether the hit represents a Snyk/CodeSec probe or a live compromise
  6. 6paysafe-gbp-virtual-assistant-lib-fe@2.0.4 - cross-reference with multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat; this is the same Paysafe-internal-lib impersonation campaign continuing three weeks later. If any paysafe-* name appears, rotate every Paysafe/Skrill integration credential and audit build-host activity
  7. 7claude-code-base-action@2.0.0/2.2.2 - this typosquats the legitimate anthropics/claude-code-base-action GitHub Action. Any .github/workflows/*.yml file referencing uses: <someone-else>/claude-code-base-action@ is compromised; the canonical action is uses: anthropics/claude-code-base-action@v1 (or a specific released tag)
  8. 8*`@vaultflow/` (2026-07-28)** - treat as HashiCorp Vault credential exfiltration. Rotate every Vault token, root token, and audit-log-visible client identity that could have been reachable
  9. 9For projects using postinstall-scripting packages, run npm install --ignore-scripts in CI as defense-in-depth and invoke scripts only for vetted first-party packages
  10. 10Verify none of the 54 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank
  11. 11Broader batch context: the 2026-07-27 GitHub Advisory Database batch spans 250+ CWE-506 advisories (12+ pages of paginated results, all dated 2026-07-27). This module catalogues 54; the balance is dominated by GHSA backfill of the pre-existing @antv/* Mini Shai-Hulud incident (npm-2026-05-19-antv-mini-shai-hulud, published 2026-05-19), which has been updated on this ingest to reflect the ongoing formal-advisory cataloguing of packages already tracked in its 261-package map

References

Back to feedSubmit a correction
npm-2026-07-28-ghsa-malware-sweep