# GitHub Advisory npm CWE-506 sweep - 60-package 2026-07-28 → 2026-07-29 backfill (9-package `@wagni_bot/*` Telegram credential-stealer scope, 6-package `2.1.6` postinstall SSH-key + file harvester cluster, 4-package `streak-*` Windows PE binary drop, 3-package `aone-*` embedded-malware trio, `xerohub-discord-voice` Discord-token stealer pair, generic-name C2 domain communicator kit, `@joyfill/*` prerelease pair, misc single-package RATs and typosquats)

> GitHub Advisory Database published 6 new npm CWE-506 advisories on 2026-07-29 plus a ~55-package 2026-07-28 backfill. Clusters: `@wagni_bot/*` 9-pkg Telegram stealer, `2.1.6` SSH-key harvester (`app-*-layer`, `api-*-sdk`), `streak-*` Windows-PE dropper, `aone-*` all-versions, `xerohub-discord-voice` token stealer, generic-name C2 kit.

- Published: 2026-07-29
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 65 packages, 77 compromised versions
- Tags: typosquat, crypto-wallet-drain, credential-theft, infostealer, dependency-confusion, ci-cd-compromise, obfuscation
- Also known as: 2026-07-28 GHSA npm backfill batch, @wagni_bot Telegram credential stealer scope, 2.1.6 SSH-key harvester cluster, streak-* Windows PE dropper
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-07-29-ghsa-malware-sweep

## Affected packages (65)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@ai_/autoprefixers](https://dependencywatch.io/package/npm/@ai_/autoprefixers) | npm | 1.2.0 |
| [@apexfnd/apex](https://dependencywatch.io/package/npm/@apexfnd/apex) | npm | 1.0.0, 1.0.1 |
| [@bowozzz/baileys](https://dependencywatch.io/package/npm/@bowozzz/baileys) | npm | 1.0.0 |
| [@crbrc/xbt](https://dependencywatch.io/package/npm/@crbrc/xbt) | npm | 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.1 |
| [@joyfill/components](https://dependencywatch.io/package/npm/@joyfill/components) | npm | 4.0.0-rc24-2773-beta.4 |
| [@joyfill/layouts](https://dependencywatch.io/package/npm/@joyfill/layouts) | npm | 0.1.2-2773.beta.0 |
| [@mypwn/hawkeye](https://dependencywatch.io/package/npm/@mypwn/hawkeye) | npm | 99.0.0 |
| [@wagni_bot/bsc](https://dependencywatch.io/package/npm/@wagni_bot/bsc) | npm | 1.0.0 |
| [@wagni_bot/eth](https://dependencywatch.io/package/npm/@wagni_bot/eth) | npm | 1.0.0 |
| [@wagni_bot/hyperliquid](https://dependencywatch.io/package/npm/@wagni_bot/hyperliquid) | npm | 1.0.0 |
| [@wagni_bot/metamask](https://dependencywatch.io/package/npm/@wagni_bot/metamask) | npm | 1.0.0 |
| [@wagni_bot/opensea](https://dependencywatch.io/package/npm/@wagni_bot/opensea) | npm | 1.0.0 |
| [@wagni_bot/polygon](https://dependencywatch.io/package/npm/@wagni_bot/polygon) | npm | 1.0.0 |
| [@wagni_bot/polymarket](https://dependencywatch.io/package/npm/@wagni_bot/polymarket) | npm | 1.0.0 |
| [@wagni_bot/wagni](https://dependencywatch.io/package/npm/@wagni_bot/wagni) | npm | 1.0.0 |
| [@wagni_bot/web3](https://dependencywatch.io/package/npm/@wagni_bot/web3) | npm | 1.0.0 |
| [@yancyyu/agentcli](https://dependencywatch.io/package/npm/@yancyyu/agentcli) | npm | 1.9.32 |
| [aone-kit](https://dependencywatch.io/package/npm/aone-kit) | npm | 1.0.0 |
| [aone-kit-cli](https://dependencywatch.io/package/npm/aone-kit-cli) | npm | 1.0.0 |
| [aone-sandbox](https://dependencywatch.io/package/npm/aone-sandbox) | npm | 1.0.0 |
| [api-node-sdk](https://dependencywatch.io/package/npm/api-node-sdk) | npm | 2.1.6 |
| [api-rust-sdk](https://dependencywatch.io/package/npm/api-rust-sdk) | npm | 2.1.6 |
| [app-sim-layer](https://dependencywatch.io/package/npm/app-sim-layer) | npm | 2.1.6 |
| [app-sima-layer](https://dependencywatch.io/package/npm/app-sima-layer) | npm | 2.1.6 |
| [app-soda-layer](https://dependencywatch.io/package/npm/app-soda-layer) | npm | 2.1.6 |
| [app-svm-layer](https://dependencywatch.io/package/npm/app-svm-layer) | npm | 2.1.6 |
| [array-node-utils](https://dependencywatch.io/package/npm/array-node-utils) | npm | 1.0.9 |
| [array-sort-helper](https://dependencywatch.io/package/npm/array-sort-helper) | npm | 1.0.0 |
| [basic-vite](https://dependencywatch.io/package/npm/basic-vite) | npm | 1.0.0 |
| [bianira-ui](https://dependencywatch.io/package/npm/bianira-ui) | npm | 1.27.0 |
| [blots](https://dependencywatch.io/package/npm/blots) | npm | 2.1.0 |
| [chain-analyze](https://dependencywatch.io/package/npm/chain-analyze) | npm | 1.0.2 |
| [chain-manager](https://dependencywatch.io/package/npm/chain-manager) | npm | 1.0.0 |
| [cloud-config-fetcher](https://dependencywatch.io/package/npm/cloud-config-fetcher) | npm | 1.0.0 |
| [color-convert-helper](https://dependencywatch.io/package/npm/color-convert-helper) | npm | 1.0.0 |
| [date-sanitize-helper](https://dependencywatch.io/package/npm/date-sanitize-helper) | npm | 1.0.0 |
| [ethers-secure](https://dependencywatch.io/package/npm/ethers-secure) | npm | 1.0.0 |
| [fluid-type-ui](https://dependencywatch.io/package/npm/fluid-type-ui) | npm | 2.0.8 |
| [jobber-app-template-react](https://dependencywatch.io/package/npm/jobber-app-template-react) | npm | 1.0.1 |
| [json-schema-inspector](https://dependencywatch.io/package/npm/json-schema-inspector) | npm | 1.1.4, 1.1.5, 1.1.6, 1.1.7 |
| [json-to-table-util](https://dependencywatch.io/package/npm/json-to-table-util) | npm | 1.0.0 |
| [kordyn](https://dependencywatch.io/package/npm/kordyn) | npm | 0.9.16, 0.9.18 |
| [korvica](https://dependencywatch.io/package/npm/korvica) | npm | 1.0.0 |
| [lib-mtop](https://dependencywatch.io/package/npm/lib-mtop) | npm | 1.0.0 |
| [lib-streak-math](https://dependencywatch.io/package/npm/lib-streak-math) | npm | 1.0.0 |
| [local-config-parser](https://dependencywatch.io/package/npm/local-config-parser) | npm | 1.0.0 |
| [node-array-plus](https://dependencywatch.io/package/npm/node-array-plus) | npm | 1.0.9 |
| [num-format-helper](https://dependencywatch.io/package/npm/num-format-helper) | npm | 1.0.0 |
| [parallely](https://dependencywatch.io/package/npm/parallely) | npm | 10.0.3 |
| [postcss-motion-utils](https://dependencywatch.io/package/npm/postcss-motion-utils) | npm | 1.0.0 |
| [react-puller](https://dependencywatch.io/package/npm/react-puller) | npm | 1.0.0 |
| [rollup-runtime-core-polyfills](https://dependencywatch.io/package/npm/rollup-runtime-core-polyfills) | npm | 0.0.1 |
| [sigchain-js](https://dependencywatch.io/package/npm/sigchain-js) | npm | 1.0.1 |
| [simple-probe-utils](https://dependencywatch.io/package/npm/simple-probe-utils) | npm | 1.0.1 |
| [smart-config-manager](https://dependencywatch.io/package/npm/smart-config-manager) | npm | 1.0.0 |
| [streak-core-lib](https://dependencywatch.io/package/npm/streak-core-lib) | npm | 1.0.0 |
| [streak-core-math](https://dependencywatch.io/package/npm/streak-core-math) | npm | 1.0.0 |
| [streak-daily-lib](https://dependencywatch.io/package/npm/streak-daily-lib) | npm | 1.0.0 |
| [string-format-kit](https://dependencywatch.io/package/npm/string-format-kit) | npm | 1.0.2 |
| [text-line-parser](https://dependencywatch.io/package/npm/text-line-parser) | npm | 1.0.0 |
| [tidal-embed-player](https://dependencywatch.io/package/npm/tidal-embed-player) | npm | 1.0.1 |
| [toll_free](https://dependencywatch.io/package/npm/toll_free) | npm | 1.0.1 |
| [triage_bot_using_sdkv3](https://dependencywatch.io/package/npm/triage_bot_using_sdkv3) | npm | 2.0.1 |
| [xerohub-discord-voice-v2](https://dependencywatch.io/package/npm/xerohub-discord-voice-v2) | npm | 1.8.0 |
| [xerohub-discord-voice-v3](https://dependencywatch.io/package/npm/xerohub-discord-voice-v3) | npm | 3.0.0, 3.0.2, 3.0.3 |

## What happened

On 2026-07-28 and 2026-07-29, the GitHub Advisory Database published a further **~60 new npm CWE-506 (Embedded Malicious Code) advisories** - 6 dated 2026-07-29 (`chain-manager`, `chain-analyze`, `@bowozzz/baileys`, `blots`, `@mypwn/hawkeye`, `toll_free`) plus a ~55-package 2026-07-28 backfill batch that appeared **after** the prior day's `npm-2026-07-28-ghsa-malware-sweep` module was authored. This module catalogues both.

The 07-28 backfill has clear operator-cluster structure - same version pins, same-scope publish signatures, same C2 patterns - indicating three coordinated multi-package campaigns and one broad OpenSSF Package Analysis auto-triage sweep, rather than 55 unrelated hobbyist typosquats.

## Cluster A - `@wagni_bot/*` Telegram credential-stealer scope (9 packages, all `1.0.0`, 2026-07-28)

| Package | Notes |
|---|---|
| `@wagni_bot/web3` | web3.js SDK impersonation |
| `@wagni_bot/wagni` | scope-root brand impersonation |
| `@wagni_bot/polygon` | Polygon SDK impersonation |
| `@wagni_bot/opensea` | OpenSea SDK impersonation |
| `@wagni_bot/hyperliquid` | Hyperliquid SDK impersonation |
| `@wagni_bot/polymarket` | Polymarket SDK impersonation |
| `@wagni_bot/metamask` | MetaMask SDK impersonation |
| `@wagni_bot/eth` | Ethereum SDK impersonation |
| `@wagni_bot/bsc` | BSC / BNB Chain SDK impersonation |

All 9 use identical postinstall payloads: fingerprint the host, search `~/`, exfil SSH keys + cryptocurrency wallet files + `~/.env` + `~/.git-credentials` to a single hardcoded Telegram bot token. Every advisory's "Details" section explicitly cross-references a 25-package `@wagni_bot` scope operator that originally published on 2026-07-09 - the 9 catalogued here are the ones GHSA formalised on 2026-07-28. Identical payload files and unified C2 across all 25 confirmed by the advisory research.

## Cluster B - `2.1.6` postinstall SSH-key + file harvester (6 packages, all `= 2.1.6`, 2026-07-28)

| Package | Notes |
|---|---|
| `app-svm-layer` | scope name suggests Solana Virtual Machine layer |
| `app-sima-layer` | scope name suggests SIMA runtime layer |
| `app-sim-layer` | scope name suggests SIM layer |
| `app-soda-layer` | scope name suggests SODA layer |
| `api-node-sdk` | generic Node SDK impersonation |
| `api-rust-sdk` | generic Rust SDK impersonation |

Every postinstall hook: (a) writes an attacker SSH public key to `~/.ssh/authorized_keys` on Linux / macOS; (b) opens SSH-port firewall rules (`ufw allow 22`, iptables INPUT accept); (c) recursively walks `~/` matching `id.json`, `config.toml`, `.env*`, `*.pem`, Solana / Sui / Sei keypair files; (d) POSTs the harvested files + host metadata over plaintext HTTP to `95.216.118.146` on TCP `3000` and `3001`. Behaviour + identical `2.1.6` version-pin across 6 packages is a single-operator signature - probable coordinated Solana-adjacent SDK-impersonation campaign.

## Cluster C - `streak-*` Windows PE binary dropper + WSL escalation (4 packages, all `1.0.0`, 2026-07-28)

| Package | Notes |
|---|---|
| `streak-core-lib` | drops `vite-native-helper.exe` |
| `streak-core-math` | fetches + executes hex-encoded binary |
| `streak-daily-lib` | WSL-to-Windows privilege escalation |
| `lib-streak-math` | Linux daemon + Windows Startup dual-persistence |

Each masquerades as a "day-math primitives" library; on import the module extracts (or fetches) a Windows PE binary and deposits it into the user's `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup` folder - persistent execution at every logon. `streak-daily-lib` uniquely calls out to `powershell.exe` from inside a WSL session, achieving WSL→Windows cross-boundary privilege escalation. `lib-streak-math` supports both Windows and Linux targets with a detached background daemon on Linux.

## Cluster D - `aone-*` all-versions embedded malware (3 packages, `>= 0`, 2026-07-28)

| Package | Notes |
|---|---|
| `aone-kit` | all versions |
| `aone-kit-cli` | all versions |
| `aone-sandbox` | all versions |

Same-scope coordinated publish with the boilerplate CWE-506 disclosure text and no functional legitimate code. The `aone-*` naming strongly hints at Alibaba's internal `Aone` DevOps / build platform - likely dep-confusion probes against Alibaba internal-lib names. Treat the whole scope as attacker-owned.

## Cluster E - `xerohub-discord-voice-v2`/`v3` Discord token stealer pair (2 packages, 2026-07-28)

| Package | Versions | Notes |
|---|---|---|
| `xerohub-discord-voice-v2` | `1.8.0` | POST Discord token → hardcoded webhook |
| `xerohub-discord-voice-v3` | `3.0.0`, `3.0.2`, `3.0.3` | same theft path, three versions |

On any call to the exported `startVoiceJoiner(config)` function, the code POSTs `USER_TOKEN`, `USER_TOKEN_2`, `VOICE_SERVER_ID`, and `VOICE_CHANNEL_ID` via `axios` to a hardcoded `discord.com/api/webhooks/...` URL owned by the package author. All axios errors are deliberately swallowed to hide the theft from the caller.

## Cluster F - generic-name C2 domain communicator kit (7 packages, 2026-07-28)

| Package | Version | Notes |
|---|---|---|
| `num-format-helper` | `1.0.0` | OpenSSF PA: "communicates with malicious domains" |
| `string-format-kit` | `1.0.2` | same signature |
| `date-sanitize-helper` | `1.0.0` | same signature |
| `json-to-table-util` | `1.0.0` | same signature |
| `array-sort-helper` | `1.0.0` | same signature |
| `color-convert-helper` | `1.0.0` | AWS IAM cred harvest + internal-net recon |
| `simple-probe-utils` | `1.0.1` | AWS IAM + cloud metadata exfil |

All 7 flagged with near-identical OpenSSF Package Analysis triggers within the same day. Names deliberately generic to blend with legitimate utility libraries. The two with more specific behaviour analysis (`color-convert-helper`, `simple-probe-utils`) both do cloud IAM credential theft - consistent with the rest of the cluster likely doing the same behind the boilerplate description.

## Cluster G - `@joyfill/*` prerelease-tag pair (2 packages, 2026-07-28)

| Package | Version | Notes |
|---|---|---|
| `@joyfill/layouts` | `0.1.2-2773.beta.0` | unusual prerelease tag |
| `@joyfill/components` | `4.0.0-rc24-2773-beta.4` | unusual `rc24` + `2773` prerelease tag |

Coordinated same-scope publish under prerelease version tags. The `2773` numeric signature is present in both - a strong shared-operator indicator. Prerelease-tag hijacks slip past `npm install` when `--prefer-online` is set or when a lockfile explicitly pins a beta.

## Cluster H - miscellaneous single-package RATs and typosquats (22 packages, 2026-07-28)

See the packages map below for the complete list with versions. High-signal picks: `parallely@10.0.3` (`concurrently` typosquat, platform-specific dropper); `ethers-secure@1.0.0` (`ethers.js` typosquat, private-key exfil on wallet-function call); `@ai_/autoprefixers@1.2.0` (`autoprefixer` typosquat with underscore-prefix + trailing-s); `@apexfnd/apex@1.0.0`/`1.0.1` (root-priv postinstall on macOS); `@yancyyu/agentcli@1.9.32` (Lark/Feishu keychain-credential exfil - Chinese-enterprise-tooling target); `@crbrc/xbt@1.1.0`-`1.1.4`/`1.2.1` (OxaPay payment-credential exfil + TCP backdoor relay); `bianira-ui@1.27.0` and `fluid-type-ui@2.0.8` (both use blockchain-based C2 resolution - Ethereum contract lookup for the payload URL); `react-puller@1.0.0` (Windows registry persistence - Run key modification).

## Cluster I - all-versions generic-name credential stealers (5 packages, 2026-07-28, `>= 0`)

`postcss-motion-utils`, `local-config-parser`, `lib-mtop`, `cloud-config-fetcher`, `smart-config-manager`. All 5 flagged all-versions with the boilerplate CWE-506 disclosure. The `cloud-config-fetcher` + `smart-config-manager` naming pattern reads as dep-confusion targeting a Java/Spring internal-lib namespace but published to npm - check whether your build resolves those names cross-ecosystem.

## 2026-07-29 OpenSSF Package Analysis batch (6 packages)

| Package | Version | Notes |
|---|---|---|
| `chain-manager` | all versions | OpenSSF PA CWE-506 |
| `chain-analyze` | all versions | follow-up to 07-28 `1.0.2` disclosure (GHSA-gqcp-j8hr-w48x); both versions catalogued below |
| `@bowozzz/baileys` | all versions | `@whiskeysockets/baileys` scope typosquat via `bowozzz` |
| `blots` | `2.1.0` | OpenSSF PA generic malicious-command trigger |
| `@mypwn/hawkeye` | `99.0.0` | dep-confusion-style inflated major version |
| `toll_free` | `1.0.1` | OpenSSF PA generic malicious-command trigger |

## Registry state

All 60 packages security-replaced with `0.0.1-security` sentinel tarballs during the 2026-07-28 / 2026-07-29 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Extends `npm-2026-07-28-ghsa-malware-sweep` (54 packages), which catalogued the initial 2026-07-27 → 2026-07-28 batch before this backfill appeared.
- The Solana-keypair harvest behaviour in Cluster B echoes `multi-2026-06-12-solana-fakefix-jfrog` and `npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie` - the plaintext HTTP C2 at `95.216.118.146` is not attributed to a named actor in the GHSA advisories, so no `threatActor` field is set.

## Impact

- Any host that installed any of the 60 npm packages listed below should be treated as fully compromised - every GHSA record uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
- **Cluster A - `@wagni_bot/*` Telegram credential-stealer scope** (9 packages, all `1.0.0`, all published 2026-07-28): `@wagni_bot/web3`, `@wagni_bot/wagni`, `@wagni_bot/polygon`, `@wagni_bot/opensea`, `@wagni_bot/hyperliquid`, `@wagni_bot/polymarket`, `@wagni_bot/metamask`, `@wagni_bot/eth`, `@wagni_bot/bsc`. Every package fingerprints the host on postinstall, harvests SSH keys / cryptocurrency wallet files / `~/.env` / `~/.git-credentials`, and exfiltrates to a hardcoded Telegram bot token - one operator, identical payloads across all 9 with unified C2. Advisory text explicitly attributes to a 25-package `@wagni_bot` scope campaign that first published 2026-07-09; the 9 covered here are the ones GHSA formalised on 2026-07-28
- **Cluster B - `2.1.6` postinstall SSH-key + file harvester** (6 packages, all published 2026-07-28 with the identical `= 2.1.6` version signature): `app-svm-layer`, `app-sima-layer`, `app-sim-layer`, `app-soda-layer`, `api-node-sdk`, `api-rust-sdk`. Every postinstall hook installs an attacker SSH public key, opens SSH-port firewall rules, harvests `id.json` / `config.toml` / `.env*` / Solana keypair files, and exfiltrates over plaintext HTTP to `95.216.118.146:3000/3001`. Behaviour and version-pin signature strongly suggest a single operator running a coordinated Solana-adjacent SDK-impersonation campaign
- **Cluster C - `streak-*` Windows PE binary drop + WSL escalation** (4 packages, all `1.0.0`): `streak-core-lib`, `streak-core-math`, `streak-daily-lib`, `lib-streak-math`. Each masquerades as day-math primitives; on import extracts a Windows PE binary (e.g. `vite-native-helper.exe`) into the user's `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup` folder, achieving persistence at every logon. `streak-daily-lib` additionally performs WSL-to-Windows privilege escalation via `powershell.exe` invocation from inside the Linux subsystem
- **Cluster D - `aone-*` all-versions embedded malware** (3 packages, every version `>= 0`): `aone-kit`, `aone-kit-cli`, `aone-sandbox`. Same-scope coordinated publish with the boilerplate CWE-506 disclosure and no functional legitimate code - treat as pure attacker-owned scope, likely dep-confusion probes against Alibaba's internal `aone` build system
- **Cluster E - `xerohub-discord-voice-v2`/`v3` Discord-token stealer pair** (`v2` at `1.8.0`, `v3` at `3.0.0`/`3.0.2`/`3.0.3`): `startVoiceJoiner(config)` POSTs the caller-supplied Discord token, secondary token, voice-server ID, and channel ID via `axios` to a hardcoded `discord.com/api/webhooks/...` URL controlled by the attacker; errors are silently swallowed to hide the theft
- **Cluster F - generic-name C2 domain communicator kit** (7 packages, all `1.0.0`/`1.0.1`/`1.0.2`): `num-format-helper`, `string-format-kit`, `date-sanitize-helper`, `json-to-table-util`, `array-sort-helper`, `color-convert-helper`, `simple-probe-utils`. All flagged with near-identical OpenSSF Package Analysis triggers ("communicates with domains associated with malicious activity and executes commands linked to harmful behavior") - likely one operator publishing under generic utility-library names to harvest AWS IAM credentials + cloud metadata
- **Cluster G - `@joyfill/*` prerelease-tag pair** (2 packages, unusual prerelease version strings `0.1.2-2773.beta.0` and `4.0.0-rc24-2773-beta.4`): `@joyfill/layouts`, `@joyfill/components`. Coordinated same-scope publish under prerelease tags - same signature indicates dep-confusion / test-tag hijack against Joyfill's legitimate `@joyfill/*` npm packages
- **Cluster H - misc high-signal single-package RATs**: `sigchain-js@1.0.1` (bundled payload decrypts + runs code from companion packages during install), `text-line-parser@1.0.0` (env-var + cloud-cred exfil), `triage_bot_using_sdkv3@2.0.1` (preinstall recon + file exfil), `rollup-runtime-core-polyfills@0.0.1` (base64-decoded loader for `svgcraft-core` attacker module), `tidal-embed-player@1.0.1`, `json-schema-inspector@1.1.4`-`1.1.7` (AES-256 remote payload decrypt), `parallely@10.0.3` (`concurrently` typosquat, platform-specific dropper), `jobber-app-template-react@1.0.1` (recon + file exfil disguised as React template), `basic-vite@1.0.0` (system-data exfil preinstall), `array-node-utils@1.0.9` / `node-array-plus@1.0.9` (fetch-decrypt-execute remote payload pair - likely same operator, paired name signature), `react-puller@1.0.0` (Windows binary + registry persistence), `ethers-secure@1.0.0` (`ethers.js` typosquat, private-key exfil on wallet-function call), `bianira-ui@1.27.0` (blockchain-based C2 resolution with encrypted dynamic payload), `kordyn@0.9.16`/`0.9.18` (Windows PE64 to Startup on WSL import), `korvica@1.0.0` (Windows binary fetch on WSL Linux import), `@apexfnd/apex@1.0.0`/`1.0.1` (root-priv remote-code postinstall on macOS), `@yancyyu/agentcli@1.9.32` (Lark/Feishu keychain-credential exfil), `@ai_/autoprefixers@1.2.0` (`autoprefixer` typosquat, encrypted-C2 shell exec), `@crbrc/xbt@1.1.0`-`1.1.4`/`1.2.1` (OxaPay-payment-credential exfil + TCP backdoor relay), `fluid-type-ui@2.0.8` (Ethereum-blockchain C2 with encrypted payload)
- **Cluster I - all-versions generic-name credential stealers** (5 packages, every version `>= 0`): `postcss-motion-utils`, `local-config-parser`, `lib-mtop`, `cloud-config-fetcher`, `smart-config-manager`. Every version replaced with `0.0.1-security` sentinel; treat any lockfile pin as pre-yank confirmed compromise
- **2026-07-29 OpenSSF Package Analysis batch** (6 packages): `chain-manager` (all versions), `chain-analyze` (all versions - 2nd advisory follow-up on the 07-28 `1.0.2` disclosure), `@bowozzz/baileys` (all versions), `blots@2.1.0`, `@mypwn/hawkeye@99.0.0` (dep-confusion-style inflated major), `toll_free@1.0.1`
- None of the 60 packages retain original tarballs on the public npm registry - all replaced with `0.0.1-security` sentinels. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **Highest priority - Cluster B (2.1.6 SSH-key harvester)**: any hit on `app-svm-layer`, `app-sima-layer`, `app-sim-layer`, `app-soda-layer`, `api-node-sdk`, or `api-rust-sdk` at `2.1.6` requires: (1) remove any unrecognised entries from `~/.ssh/authorized_keys` on Linux/macOS build hosts, (2) audit host firewall for newly-opened inbound SSH rules, (3) block outbound to `95.216.118.146` and audit HTTP proxy logs for that IP across the exposure window, (4) rotate every Solana keypair, `id.json`, `config.toml`, and `.env*` value reachable from the build host
3. **Cluster A (`@wagni_bot/*` Telegram stealer)**: any hit on `@wagni_bot/web3`, `@wagni_bot/wagni`, `@wagni_bot/polygon`, `@wagni_bot/opensea`, `@wagni_bot/hyperliquid`, `@wagni_bot/polymarket`, `@wagni_bot/metamask`, `@wagni_bot/eth`, or `@wagni_bot/bsc` at `1.0.0`: treat as full crypto-wallet-compromise event. Move funds via a clean device BEFORE attempting rotation. Rotate every SSH key, `.env`-stored secret, and browser-wallet extension seed accessible from the dev host
4. **Cluster C (`streak-*` Windows-PE dropper)**: any hit on `streak-core-lib`, `streak-core-math`, `streak-daily-lib`, or `lib-streak-math` at `1.0.0` on a Windows host or a WSL environment: check `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup` for unrecognised `.exe` files (specifically `vite-native-helper.exe` / `edge-native-helper.exe`-style names). Wipe and re-image the host - startup-folder persistence combined with the WSL cross-boundary payload means the malicious binary re-launches every logon
5. **Cluster E (`xerohub-discord-voice-v2/v3` token stealer)**: any hit at the listed versions: rotate the exposed Discord bot token (Developer Portal → Bot → Regenerate), reset user account passwords that ever ran the compromised code, and audit the target Discord server's webhook list for attacker-owned URLs
6. **Cluster G (`@joyfill/*` prerelease-tag pair)**: verify no lockfile pins the two malicious prerelease tags (`0.1.2-2773.beta.0` on `@joyfill/layouts`, `4.0.0-rc24-2773-beta.4` on `@joyfill/components`). Prerelease-tag hijacks slip past standard version-range resolvers when `npm install --prefer-online` runs - pin to explicit stable versions and set `.npmrc` `save-prefix=""` in ephemeral CI images
7. **Cluster D + Cluster I (all-versions generic-name malware)**: for `aone-kit`, `aone-kit-cli`, `aone-sandbox`, `postcss-motion-utils`, `local-config-parser`, `lib-mtop`, `cloud-config-fetcher`, `smart-config-manager` - any lockfile match at any version is a compromise. If these names look like internal-scope hits (e.g. Alibaba `aone` build tooling), configure `.npmrc` scope→registry mapping to keep private-name resolution off the public registry
8. For projects using `postinstall`-scripting packages, run `npm install --ignore-scripts` in CI as defense-in-depth and invoke scripts only for vetted first-party packages
9. Verify none of the 60 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-257g-ggr2-j398 - chain-manager malware advisory](https://github.com/advisories/GHSA-257g-ggr2-j398) - GitHub
- [GHSA-vmj5-cm6w-jrgj - chain-analyze malware advisory (2026-07-29 follow-up)](https://github.com/advisories/GHSA-vmj5-cm6w-jrgj) - GitHub
- [GHSA-f9vh-885g-hv2f - @bowozzz/baileys malware advisory](https://github.com/advisories/GHSA-f9vh-885g-hv2f) - GitHub
- [GHSA-m24q-pqxm-qhqw - blots malware advisory](https://github.com/advisories/GHSA-m24q-pqxm-qhqw) - GitHub
- [GHSA-28p4-h97c-j397 - @mypwn/hawkeye malware advisory](https://github.com/advisories/GHSA-28p4-h97c-j397) - GitHub
- [GHSA-8grw-9ghp-8r94 - toll_free malware advisory](https://github.com/advisories/GHSA-8grw-9ghp-8r94) - GitHub
- [GHSA-48gg-v3w4-m38v - @wagni_bot/web3 malware advisory](https://github.com/advisories/GHSA-48gg-v3w4-m38v) - GitHub
- [GHSA-c324-fqr6-v3cw - @wagni_bot/wagni malware advisory](https://github.com/advisories/GHSA-c324-fqr6-v3cw) - GitHub
- [GHSA-5w5j-423r-2x73 - @wagni_bot/polygon malware advisory](https://github.com/advisories/GHSA-5w5j-423r-2x73) - GitHub
- [GHSA-c84m-x93c-fwjj - @wagni_bot/opensea malware advisory](https://github.com/advisories/GHSA-c84m-x93c-fwjj) - GitHub
- [GHSA-35jp-phg5-g2hr - @wagni_bot/hyperliquid malware advisory](https://github.com/advisories/GHSA-35jp-phg5-g2hr) - GitHub
- [GHSA-46gp-xx3g-2cqr - @wagni_bot/polymarket malware advisory](https://github.com/advisories/GHSA-46gp-xx3g-2cqr) - GitHub
- [GHSA-vg7p-qg4j-56rc - @wagni_bot/metamask malware advisory](https://github.com/advisories/GHSA-vg7p-qg4j-56rc) - GitHub
- [GHSA-vr92-xmj8-jr8v - @wagni_bot/eth malware advisory](https://github.com/advisories/GHSA-vr92-xmj8-jr8v) - GitHub
- [GHSA-r3x3-gxmq-rmhj - @wagni_bot/bsc malware advisory](https://github.com/advisories/GHSA-r3x3-gxmq-rmhj) - GitHub
- [GHSA-7m36-xw8v-8hq9 - app-svm-layer malware advisory](https://github.com/advisories/GHSA-7m36-xw8v-8hq9) - GitHub
- [GHSA-gxmw-r885-6v87 - app-sima-layer malware advisory](https://github.com/advisories/GHSA-gxmw-r885-6v87) - GitHub
- [GHSA-363f-gw2q-m6j5 - app-sim-layer malware advisory](https://github.com/advisories/GHSA-363f-gw2q-m6j5) - GitHub
- [GHSA-2q8x-gg6r-p5hg - app-soda-layer malware advisory](https://github.com/advisories/GHSA-2q8x-gg6r-p5hg) - GitHub
- [GHSA-c836-6399-93jv - api-node-sdk malware advisory](https://github.com/advisories/GHSA-c836-6399-93jv) - GitHub
- [GHSA-4hhr-c99m-jq9f - api-rust-sdk malware advisory](https://github.com/advisories/GHSA-4hhr-c99m-jq9f) - GitHub
- [GHSA-7vpc-qq63-xvwj - streak-core-lib malware advisory](https://github.com/advisories/GHSA-7vpc-qq63-xvwj) - GitHub
- [GHSA-g827-wm64-px2q - streak-core-math malware advisory](https://github.com/advisories/GHSA-g827-wm64-px2q) - GitHub
- [GHSA-456x-5qpf-qrrw - streak-daily-lib malware advisory](https://github.com/advisories/GHSA-456x-5qpf-qrrw) - GitHub
- [GHSA-7hfx-rf8h-6j2g - lib-streak-math malware advisory](https://github.com/advisories/GHSA-7hfx-rf8h-6j2g) - GitHub
- [GHSA-7w6g-48pj-7977 - aone-kit malware advisory](https://github.com/advisories/GHSA-7w6g-48pj-7977) - GitHub
- [GHSA-55qq-2qq4-c47g - aone-kit-cli malware advisory](https://github.com/advisories/GHSA-55qq-2qq4-c47g) - GitHub
- [GHSA-mv5v-q5f3-gf7h - aone-sandbox malware advisory](https://github.com/advisories/GHSA-mv5v-q5f3-gf7h) - GitHub
- [GHSA-3h72-42vm-wphp - xerohub-discord-voice-v2 malware advisory](https://github.com/advisories/GHSA-3h72-42vm-wphp) - GitHub
- [GHSA-xw2v-59xv-3c84 - xerohub-discord-voice-v3 malware advisory](https://github.com/advisories/GHSA-xw2v-59xv-3c84) - GitHub
- [GHSA-jf75-cqhp-mhch - num-format-helper malware advisory](https://github.com/advisories/GHSA-jf75-cqhp-mhch) - GitHub
- [GHSA-xqqx-722m-55gr - string-format-kit malware advisory](https://github.com/advisories/GHSA-xqqx-722m-55gr) - GitHub
- [GHSA-jj2h-2x77-rrwf - date-sanitize-helper malware advisory](https://github.com/advisories/GHSA-jj2h-2x77-rrwf) - GitHub
- [GHSA-j9fg-prmr-97cw - json-to-table-util malware advisory](https://github.com/advisories/GHSA-j9fg-prmr-97cw) - GitHub
- [GHSA-mx6g-xr3v-fc2f - array-sort-helper malware advisory](https://github.com/advisories/GHSA-mx6g-xr3v-fc2f) - GitHub
- [GHSA-4682-ww49-563f - color-convert-helper malware advisory](https://github.com/advisories/GHSA-4682-ww49-563f) - GitHub
- [GHSA-9j4g-h77m-3g6m - simple-probe-utils malware advisory](https://github.com/advisories/GHSA-9j4g-h77m-3g6m) - GitHub
- [GHSA-887f-rwr9-wp54 - @joyfill/layouts malware advisory](https://github.com/advisories/GHSA-887f-rwr9-wp54) - GitHub
- [GHSA-x4p3-wjxx-m4x5 - @joyfill/components malware advisory](https://github.com/advisories/GHSA-x4p3-wjxx-m4x5) - GitHub
- [GHSA-j78w-wm55-982q - sigchain-js malware advisory](https://github.com/advisories/GHSA-j78w-wm55-982q) - GitHub
- [GHSA-hp3v-hcrw-9mf8 - text-line-parser malware advisory](https://github.com/advisories/GHSA-hp3v-hcrw-9mf8) - GitHub
- [GHSA-8pwc-32rm-4cgm - triage_bot_using_sdkv3 malware advisory](https://github.com/advisories/GHSA-8pwc-32rm-4cgm) - GitHub
- [GHSA-j877-m36j-5p92 - rollup-runtime-core-polyfills malware advisory](https://github.com/advisories/GHSA-j877-m36j-5p92) - GitHub
- [GHSA-gfxj-v4hg-f5h7 - tidal-embed-player malware advisory](https://github.com/advisories/GHSA-gfxj-v4hg-f5h7) - GitHub
- [GHSA-m8v5-qxc2-v92m - json-schema-inspector malware advisory](https://github.com/advisories/GHSA-m8v5-qxc2-v92m) - GitHub
- [GHSA-mxc4-6gh5-wpvw - parallely malware advisory](https://github.com/advisories/GHSA-mxc4-6gh5-wpvw) - GitHub
- [GHSA-j6qc-95jf-9rqf - jobber-app-template-react malware advisory](https://github.com/advisories/GHSA-j6qc-95jf-9rqf) - GitHub
- [GHSA-x36g-6hf7-wr48 - basic-vite malware advisory](https://github.com/advisories/GHSA-x36g-6hf7-wr48) - GitHub
- [GHSA-gv25-mh5m-p7gp - array-node-utils malware advisory](https://github.com/advisories/GHSA-gv25-mh5m-p7gp) - GitHub
- [GHSA-mgw3-3jfq-3gwx - node-array-plus malware advisory](https://github.com/advisories/GHSA-mgw3-3jfq-3gwx) - GitHub
- [GHSA-pg26-7r73-h7pp - react-puller malware advisory](https://github.com/advisories/GHSA-pg26-7r73-h7pp) - GitHub
- [GHSA-gqcp-j8hr-w48x - chain-analyze (2026-07-28 1.0.2) malware advisory](https://github.com/advisories/GHSA-gqcp-j8hr-w48x) - GitHub
- [GHSA-379c-c2fc-xj46 - ethers-secure malware advisory](https://github.com/advisories/GHSA-379c-c2fc-xj46) - GitHub
- [GHSA-w3r2-397p-xcfw - bianira-ui malware advisory](https://github.com/advisories/GHSA-w3r2-397p-xcfw) - GitHub
- [GHSA-4mhx-3hm9-cfpf - kordyn malware advisory](https://github.com/advisories/GHSA-4mhx-3hm9-cfpf) - GitHub
- [GHSA-5h49-444p-9g8v - korvica malware advisory](https://github.com/advisories/GHSA-5h49-444p-9g8v) - GitHub
- [GHSA-r3xx-75gm-53pm - @apexfnd/apex malware advisory](https://github.com/advisories/GHSA-r3xx-75gm-53pm) - GitHub
- [GHSA-wqc4-72w7-qr9g - @yancyyu/agentcli malware advisory](https://github.com/advisories/GHSA-wqc4-72w7-qr9g) - GitHub
- [GHSA-8hhx-8x59-hr55 - @ai_/autoprefixers malware advisory](https://github.com/advisories/GHSA-8hhx-8x59-hr55) - GitHub
- [GHSA-f3f6-vqm6-jv4v - @crbrc/xbt malware advisory](https://github.com/advisories/GHSA-f3f6-vqm6-jv4v) - GitHub
- [GHSA-44q9-v3f9-xcx6 - fluid-type-ui malware advisory](https://github.com/advisories/GHSA-44q9-v3f9-xcx6) - GitHub
- [GHSA-m763-9wch-p9gg - postcss-motion-utils malware advisory](https://github.com/advisories/GHSA-m763-9wch-p9gg) - GitHub
- [GHSA-f463-rm4g-746g - local-config-parser malware advisory](https://github.com/advisories/GHSA-f463-rm4g-746g) - GitHub
- [GHSA-vrrg-j2c5-mj4v - lib-mtop malware advisory](https://github.com/advisories/GHSA-vrrg-j2c5-mj4v) - GitHub
- [GHSA-25r8-r3cf-28q4 - cloud-config-fetcher malware advisory](https://github.com/advisories/GHSA-25r8-r3cf-28q4) - GitHub
- [GHSA-v644-r975-m85m - smart-config-manager malware advisory](https://github.com/advisories/GHSA-v644-r975-m85m) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-29-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-29-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).