# GitHub Advisory npm CWE-506 sweep - 28-package late 2026-07-29 backfill (`@ai-plus`/`@ai-agent-node` 5-pkg AI-agent SDK cluster, 5-pkg Polymarket / prediction-market impersonator kit, `@peptide-unit` scope pair, 6-pkg Alibaba-adjacent `lzd-*`/`uniapi-*`/`aone-cloud-cli`/`colder-cli`/`lwp-web-client`/`def-open-client` scope, `@zannstore/baileys` 17-version WhatsApp SDK typosquat, misc single-package RATs including `eslintcmd` ESLint typosquat)

> GitHub Advisory Database published a further 28 npm CWE-506 advisories dated 2026-07-29 after the prior day's ingest - clusters: `@ai-plus`/`@ai-agent-node` 5-pkg AI-agent SDK scopes, 5-pkg Polymarket / prediction-market impersonator kit (`polymarket-risk-manager`, `poly-kelly`, `ts-precision`, `ts-bn-proto`, `stake-math`), `@peptide-unit` pair, 6-pkg Alibaba-adjacent scope, `@zannstore/baileys` 17-version WhatsApp SDK typosquat.

- Published: 2026-07-30
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 28 packages, 44 compromised versions
- Tags: typosquat, crypto-wallet-drain, credential-theft, infostealer, dependency-confusion, ci-cd-compromise
- Also known as: 2026-07-29 late GHSA npm backfill, Polymarket prediction-market impersonator kit, @ai-plus / @ai-agent-node AI-agent SDK cluster, @peptide-unit biotech scope pair, @zannstore/baileys WhatsApp SDK typosquat
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-07-30-ghsa-malware-sweep

## Affected packages (28)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@ai-agent-node/agent-node](https://dependencywatch.io/package/npm/@ai-agent-node/agent-node) | npm | 1.0.0 |
| [@ai-agent-node/createnode](https://dependencywatch.io/package/npm/@ai-agent-node/createnode) | npm | 1.0.0 |
| [@ai-agent-node/nodesql](https://dependencywatch.io/package/npm/@ai-agent-node/nodesql) | npm | 1.0.0 |
| [@ai-plus/de-agent](https://dependencywatch.io/package/npm/@ai-plus/de-agent) | npm | 1.0.0 |
| [@ai-plus/de-agent-sdk](https://dependencywatch.io/package/npm/@ai-plus/de-agent-sdk) | npm | 1.0.0 |
| [@finxsecdemo/utils](https://dependencywatch.io/package/npm/@finxsecdemo/utils) | npm | 1.0.2 |
| [@omniwatch-wick/cli](https://dependencywatch.io/package/npm/@omniwatch-wick/cli) | npm | 1.0.0 |
| [@peptide-unit/js-unimode](https://dependencywatch.io/package/npm/@peptide-unit/js-unimode) | npm | 1.0.0 |
| [@peptide-unit/peptide-modify](https://dependencywatch.io/package/npm/@peptide-unit/peptide-modify) | npm | 1.0.0 |
| [@zannstore/baileys](https://dependencywatch.io/package/npm/@zannstore/baileys) | npm | 2.2.6, 2.2.7, 2.2.8, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.9, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4 |
| [aone-cloud-cli](https://dependencywatch.io/package/npm/aone-cloud-cli) | npm | 1.0.0 |
| [colder-cli](https://dependencywatch.io/package/npm/colder-cli) | npm | 1.0.0 |
| [data-parser-utils](https://dependencywatch.io/package/npm/data-parser-utils) | npm | 1.0.0 |
| [def-open-client](https://dependencywatch.io/package/npm/def-open-client) | npm | 1.0.0 |
| [eslintcmd](https://dependencywatch.io/package/npm/eslintcmd) | npm | 1.0.0 |
| [feedback-ai-sdk](https://dependencywatch.io/package/npm/feedback-ai-sdk) | npm | 1.0.0 |
| [flight-compare-analyzer](https://dependencywatch.io/package/npm/flight-compare-analyzer) | npm | 1.0.0 |
| [lwp-web-client](https://dependencywatch.io/package/npm/lwp-web-client) | npm | 1.0.0 |
| [lzd-unified-station-sdk](https://dependencywatch.io/package/npm/lzd-unified-station-sdk) | npm | 1.0.0 |
| [open-worker-cli](https://dependencywatch.io/package/npm/open-worker-cli) | npm | 1.0.0 |
| [poly-kelly](https://dependencywatch.io/package/npm/poly-kelly) | npm | 1.0.0 |
| [polymarket-risk-manager](https://dependencywatch.io/package/npm/polymarket-risk-manager) | npm | 1.0.0 |
| [stake-math](https://dependencywatch.io/package/npm/stake-math) | npm | 1.0.0 |
| [test-skill-zip](https://dependencywatch.io/package/npm/test-skill-zip) | npm | 1.0.0 |
| [ts-bn-proto](https://dependencywatch.io/package/npm/ts-bn-proto) | npm | 1.0.0 |
| [ts-precision](https://dependencywatch.io/package/npm/ts-precision) | npm | 1.0.0 |
| [uniapi-bridge](https://dependencywatch.io/package/npm/uniapi-bridge) | npm | 1.0.0 |
| [zer0code](https://dependencywatch.io/package/npm/zer0code) | npm | 0.2.0 |

## What happened

On 2026-07-29 (published throughout the day, largely AFTER the `npm-2026-07-29-ghsa-malware-sweep` module was authored earlier the same UTC day), the GitHub Advisory Database published **a further 28 new npm CWE-506 (Embedded Malicious Code) advisories**. This module catalogues that late-day 2026-07-29 backfill batch - the prior module's "2026-07-29 batch (6 packages)" only saw the 6 that were live at the time it was authored.

The 28-package batch has clear operator-cluster structure - coordinated same-scope publishes, thematically-grouped naming, and same-day CWE-506 boilerplate signatures - indicating four coordinated multi-package campaigns and a scatter of single-package RATs, rather than 28 unrelated hobbyist typosquats.

## Cluster A - `@ai-plus/*` + `@ai-agent-node/*` AI-agent SDK impersonation scopes (5 packages, all `>= 0`, all 2026-07-29)

| Package | Notes |
|---|---|
| `@ai-plus/de-agent-sdk` | "de-agent" SDK impersonation |
| `@ai-plus/de-agent` | matching non-SDK entry |
| `@ai-agent-node/createnode` | agent-node factory impersonation |
| `@ai-agent-node/agent-node` | scope-root brand impersonation |
| `@ai-agent-node/nodesql` | agent-node SQL integration impersonation |

Two coordinated attacker-owned scopes publishing under generic AI-agent-tooling names in the same 24h window. Same-day, same-CWE-506 boilerplate, same all-versions signature - probable single-operator running scope-diverse AI-agent-adjacent malware to catch developers experimenting with agent-SDK integrations. Consistent with the broader 2026 AI-tooling supply-chain-attack surface previously catalogued in `npm-2026-02-17-cline-clinejection`, `multi-2026-04-29-promptmink-validate-sdk`, and `npm-2026-04-15-kindo-selfbot-xworm`.

## Cluster B - Polymarket / prediction-market tooling impersonator kit (5 packages, all `>= 0`, all 2026-07-29)

| Package | Notes |
|---|---|
| `polymarket-risk-manager` | Polymarket risk / position-sizing impersonation |
| `poly-kelly` | Kelly-criterion bet-sizing (Polymarket trading bots) |
| `ts-precision` | `bn.js`-precision math impersonation |
| `ts-bn-proto` | `bn.js` prototype impersonation |
| `stake-math` | staking / DeFi position-math impersonation |

Names read as a coordinated set: risk-manager + Kelly-criterion + precision math + big-number arithmetic + staking math - all mathematical primitives a Polymarket / CLOB trading bot would import. Same-day publish across all five is a strong single-operator signal. Extends the operator space around `npm-2026-07-17-polymarket-trap-clob-client-math` (@polymarket/clob-client math wrappers) and the June `polymarket-clob-math-vercel-loader` cluster. Treat any hit on a host running Polymarket trading bots as a full crypto-wallet-compromise event.

## Cluster C - `@peptide-unit/*` biotech / chemistry scope pair (2 packages, all `>= 0`, all 2026-07-29)

| Package | Notes |
|---|---|
| `@peptide-unit/peptide-modify` | peptide-modification tool impersonation |
| `@peptide-unit/js-unimode` | nonsense-name paired publish |

Coordinated same-scope publish under domain-specific-sounding biotech names. The `js-unimode` sibling is telling - a nonsense name paired with a plausibly-domain-specific name is classic dep-confusion probe signature against an internal peptide-analysis library namespace at a biotech / pharma customer.

## Cluster D - Alibaba-adjacent Lazada / uni-app / Aone scope (6 packages, all `>= 0`, all 2026-07-29)

| Package | Notes |
|---|---|
| `lzd-unified-station-sdk` | Lazada (`lzd`) unified-station seller-central SDK impersonation |
| `uniapi-bridge` | uni-app (Vue-based Alibaba cross-platform framework) SDK bridge |
| `aone-cloud-cli` | Alibaba Aone DevOps CLI - extends 07-28 `aone-kit` / `aone-kit-cli` / `aone-sandbox` cluster |
| `colder-cli` | generic CLI, Alibaba-scope naming |
| `lwp-web-client` | web-client impersonation, Alibaba-scope naming |
| `def-open-client` | open-client impersonation, Alibaba-scope naming |

All six flagged all-versions, no patched builds. Consistent with dep-confusion probes against Alibaba / Lazada / Alipay / uni-app internal-library namespaces. The `aone-cloud-cli` entry directly extends the `npm-2026-07-29-ghsa-malware-sweep` module's Cluster D (`aone-kit`, `aone-kit-cli`, `aone-sandbox`) - same day, same-scope operator continuing to enumerate Alibaba internal-lib naming.

## Cluster E - `@zannstore/baileys` WhatsApp SDK typosquat (1 package, 17 versions, 2026-07-29)

| Package | Versions | Notes |
|---|---|---|
| `@zannstore/baileys` | `2.2.6` - `2.4.4` (17 versions) | attacker-controlled shadow fork of `@whiskeysockets/baileys` |

Version-range mirrors the legitimate `@whiskeysockets/baileys` fork tree used by WhatsApp-automation bots, Discord/Telegram bridges, and multi-channel-messaging tooling. Pin-consistent versioning across 17 published versions strongly suggests an attacker maintaining a shadow fork to catch bot developers pulling `baileys` under an attacker-controlled scope. Same disclosure day as the 07-29 `@bowozzz/baileys` sibling catalogued in the prior module (probably different operator) - both leverage the popular `baileys` naming convention for bot ecosystems.

## Cluster F - misc single-package RATs, typosquats, and generic-name malware (10 packages, 2026-07-29)

| Package | Version | Notes |
|---|---|---|
| `@omniwatch-wick/cli` | all versions | CLI kit impersonation |
| `@finxsecdemo/utils` | `1.0.2` | OpenSSF PA "communicates with malicious domain" trigger - "security demo" scope |
| `zer0code` | `0.2.0` | only exact-versioned entry in the batch - targeted single-version drop |
| `flight-compare-analyzer` | all versions | commercial-travel-tooling impersonation |
| `test-skill-zip` | all versions | Amazon Alexa Skill dev tooling name |
| `feedback-ai-sdk` | all versions | AI-feedback-loop SDK impersonation |
| `open-worker-cli` | all versions | worker-thread CLI impersonation |
| `data-parser-utils` | all versions | generic-name credential stealer |
| `eslintcmd` | all versions | ESLint typosquat, developer-tooling impersonation |
| `open-worker-cli` | all versions | worker-thread CLI impersonation |

High-signal picks: `eslintcmd` will run at every CI job that references the misnamed dep - pin explicit ESLint versions and grep `.eslintrc` / `package.json` scripts. `@finxsecdemo/utils` was OpenSSF-PA-flagged rather than the generic all-versions boilerplate, suggesting active domain communication observed at analysis time. `zer0code@0.2.0` is the only exact-versioned drop in the batch - targeted rather than broad-scatter.

## Registry state

All 28 packages security-replaced with `0.0.1-security` sentinel tarballs during the 2026-07-29 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Follows `npm-2026-07-29-ghsa-malware-sweep` - that module's "2026-07-29 batch (6 packages)" catalogued only the 6 advisories live at the time it was authored; this module covers the 28 additional 2026-07-29-dated advisories GHSA published later the same UTC day.
- Cluster D `aone-cloud-cli` directly extends the 07-28 `aone-kit`/`aone-kit-cli`/`aone-sandbox` Cluster D operator profile.
- Cluster B extends the operator space around `npm-2026-07-17-polymarket-trap-clob-client-math` and the June `polymarket-clob-math-vercel-loader` cluster targeting Polymarket / CLOB trading-bot dependencies.
- No `threatActor` field is set - GHSA advisories in this batch use only the CWE-506 boilerplate with no named actor attribution.

## Impact

- Any host that installed any of the 28 npm packages listed below should be treated as fully compromised - every GHSA record uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
- **Cluster A - `@ai-plus/*` + `@ai-agent-node/*` AI-agent SDK impersonation scopes** (5 packages, all `>= 0`, all 2026-07-29): `@ai-plus/de-agent-sdk`, `@ai-plus/de-agent`, `@ai-agent-node/createnode`, `@ai-agent-node/agent-node`, `@ai-agent-node/nodesql`. Two coordinated attacker-owned scopes publishing under generic AI-agent-tooling names in the same 24h window - `de-agent`/`de-agent-sdk` in `@ai-plus`, `createnode`/`agent-node`/`nodesql` in `@ai-agent-node`. Same day, same threat class, same GHSA boilerplate - likely one operator running scope-diverse AI-agent-adjacent malware to catch developers experimenting with agent-SDK integrations
- **Cluster B - Polymarket / prediction-market tooling impersonator kit** (5 packages, all `>= 0`, all 2026-07-29): `polymarket-risk-manager`, `poly-kelly`, `ts-precision`, `ts-bn-proto`, `stake-math`. Names read as a coordinated set: `polymarket-risk-manager` targets Polymarket risk / position-sizing; `poly-kelly` targets Kelly-criterion bet sizing (used in Polymarket trading bots); `ts-precision` and `ts-bn-proto` target `bn.js` / big-number arithmetic (Polymarket/CLOB math dependencies); `stake-math` targets staking / DeFi position math. Same-day coordinated publish signature - treat as a single Polymarket-trading-bot targeting operator following the earlier `npm-2026-07-17-polymarket-trap-clob-client-math` and `internal-2026-06-*-polymarket-clob-math-vercel-loader` campaigns
- **Cluster C - `@peptide-unit/*` biotech / chemistry-scope pair** (2 packages, all `>= 0`, all 2026-07-29): `@peptide-unit/peptide-modify`, `@peptide-unit/js-unimode`. Coordinated same-scope publish under domain-specific-sounding biotech names. `@peptide-unit/js-unimode` is a nonsense-name pairing under a plausible-looking scope - classic dep-confusion probe against an internal peptide-analysis library namespace at a biotech / pharma target
- **Cluster D - Alibaba-adjacent Lazada/uni-app/Aone scope** (6 packages, all `>= 0`, all 2026-07-29): `lzd-unified-station-sdk` (`lzd` = Lazada), `uniapi-bridge` (uni-app SDK), `aone-cloud-cli` (Alibaba Aone DevOps - extends the 07-28 `aone-kit`/`aone-kit-cli`/`aone-sandbox` cluster catalogued in `npm-2026-07-29-ghsa-malware-sweep`), `colder-cli`, `lwp-web-client`, `def-open-client`. All six flagged all-versions, no patched builds. Consistent with dep-confusion probes against Alibaba / Lazada / Alipay / uni-app internal-library namespaces
- **Cluster E - `@zannstore/baileys` WhatsApp SDK typosquat** (17 versions `2.2.6` → `2.4.4`): `@zannstore/baileys`. Version-range mirrors legitimate `@whiskeysockets/baileys` fork tree (used by WhatsApp automation bots and Discord/Telegram bridges) - pin-consistent versioning strongly suggests an attacker maintaining a shadow fork to catch bot developers pulling `baileys` under an attacker-controlled scope. Same disclosure day as the 07-29 `@bowozzz/baileys` sibling catalogued in the prior module - likely different operators independently targeting the popular `baileys` naming convention
- **Cluster F - misc single-package RATs, typosquats, and generic-name malware** (10 packages, all 2026-07-29): `@omniwatch-wick/cli` (all versions - probable coordinated with 07-28 `xerohub-*` and `@yancyyu/agentcli` operator profile), `@finxsecdemo/utils@1.0.2` (OpenSSF Package Analysis "communicates with malicious domain" trigger), `zer0code@0.2.0` (only exact-versioned entry in the batch - targeted single-version drop), `flight-compare-analyzer` (all versions - commercial-travel-tooling impersonation), `test-skill-zip` (all versions - Amazon Alexa Skill dev tooling name), `feedback-ai-sdk` (all versions - AI-feedback-loop SDK impersonation), `open-worker-cli` (all versions - worker-thread CLI impersonation), `data-parser-utils` (all versions - generic-name credential stealer), `eslintcmd` (all versions - ESLint typosquat, developer-tooling impersonation), `@finxsecdemo/utils` (OpenSSF flag against a "security demo" scope - likely researcher / red-team probe left in the wild)
- None of the 28 packages retain original tarballs on the public npm registry - all replaced with `0.0.1-security` sentinel tarballs. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **Cluster B (Polymarket prediction-market impersonator kit)**: any hit on `polymarket-risk-manager`, `poly-kelly`, `ts-precision`, `ts-bn-proto`, or `stake-math` on a host that runs Polymarket / CLOB trading bots or holds market-maker keys: treat as full crypto-wallet-compromise event. Move funds via a clean device BEFORE attempting rotation. Rotate every trading-bot API token, Polymarket / CLOB signing key, and browser-wallet seed accessible from the affected host
3. **Cluster A (`@ai-plus`/`@ai-agent-node` AI-agent SDK impersonators)**: any hit on `@ai-plus/de-agent-sdk`, `@ai-plus/de-agent`, `@ai-agent-node/createnode`, `@ai-agent-node/agent-node`, or `@ai-agent-node/nodesql`: rotate every LLM API key (OpenAI / Anthropic / Google / Cohere / Mistral / OpenRouter), MCP server credentials, and agent-SDK service tokens accessible from the affected host. Audit LLM provider usage dashboards for unexpected token spend in the exposure window
4. **Cluster E (`@zannstore/baileys` typosquat)**: any lockfile hit at any version in the `2.2.6` → `2.4.4` range: rotate every WhatsApp Business API token, Meta developer credentials, and any Discord/Telegram bot tokens co-located with the bot install. Audit outbound WhatsApp / Meta API logs for unexpected message traffic during the exposure window
5. **Cluster D (Alibaba-adjacent `lzd-*`/`uniapi-*`/`aone-cloud-cli`)**: any hit on `lzd-unified-station-sdk`, `uniapi-bridge`, `aone-cloud-cli`, `colder-cli`, `lwp-web-client`, or `def-open-client`: configure `.npmrc` scope-to-registry mapping so private-name resolution never falls through to the public registry. Rotate any Alibaba Cloud / Aliyun / Lazada seller-central / uni-app SDK service credentials accessible from the affected host
6. **Cluster F single-package hits**: any lockfile hit at any listed version is a compromise. `eslintcmd` in particular is a linter-tooling typosquat that will run at every CI job - audit `.eslintrc` / `package.json` scripts for the exact name and pin explicit ESLint versions
7. For projects using `postinstall`-scripting packages, run `npm install --ignore-scripts` in CI as defense-in-depth and invoke scripts only for vetted first-party packages
8. Verify none of the 28 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-4c3x-2hh8-6pp9 - @ai-plus/de-agent-sdk malware advisory](https://github.com/advisories/GHSA-4c3x-2hh8-6pp9) - GitHub
- [GHSA-w62v-8p95-rhf2 - @ai-plus/de-agent malware advisory](https://github.com/advisories/GHSA-w62v-8p95-rhf2) - GitHub
- [GHSA-79rw-4w2g-9hr5 - @ai-agent-node/createnode malware advisory](https://github.com/advisories/GHSA-79rw-4w2g-9hr5) - GitHub
- [GHSA-h95p-8cf6-7qrc - @ai-agent-node/agent-node malware advisory](https://github.com/advisories/GHSA-h95p-8cf6-7qrc) - GitHub
- [GHSA-fm4j-w897-7h3g - @ai-agent-node/nodesql malware advisory](https://github.com/advisories/GHSA-fm4j-w897-7h3g) - GitHub
- [GHSA-jcx2-q527-7qcx - polymarket-risk-manager malware advisory](https://github.com/advisories/GHSA-jcx2-q527-7qcx) - GitHub
- [GHSA-c37j-v3j2-6gf8 - poly-kelly malware advisory](https://github.com/advisories/GHSA-c37j-v3j2-6gf8) - GitHub
- [GHSA-g38h-2r6h-pwr8 - ts-precision malware advisory](https://github.com/advisories/GHSA-g38h-2r6h-pwr8) - GitHub
- [GHSA-wxpc-r4jx-9jrw - ts-bn-proto malware advisory](https://github.com/advisories/GHSA-wxpc-r4jx-9jrw) - GitHub
- [GHSA-qcc9-j6wh-4h9h - stake-math malware advisory](https://github.com/advisories/GHSA-qcc9-j6wh-4h9h) - GitHub
- [GHSA-mw2h-4g9g-g7vv - @peptide-unit/peptide-modify malware advisory](https://github.com/advisories/GHSA-mw2h-4g9g-g7vv) - GitHub
- [GHSA-hghj-5h7q-fq5h - @peptide-unit/js-unimode malware advisory](https://github.com/advisories/GHSA-hghj-5h7q-fq5h) - GitHub
- [GHSA-2rgv-qvc2-5q4h - lzd-unified-station-sdk malware advisory](https://github.com/advisories/GHSA-2rgv-qvc2-5q4h) - GitHub
- [GHSA-wpp9-5p7g-7cjh - uniapi-bridge malware advisory](https://github.com/advisories/GHSA-wpp9-5p7g-7cjh) - GitHub
- [GHSA-c6xg-mcq6-m594 - aone-cloud-cli malware advisory](https://github.com/advisories/GHSA-c6xg-mcq6-m594) - GitHub
- [GHSA-x646-p774-9w26 - colder-cli malware advisory](https://github.com/advisories/GHSA-x646-p774-9w26) - GitHub
- [GHSA-rmm2-5g7m-wj7p - lwp-web-client malware advisory](https://github.com/advisories/GHSA-rmm2-5g7m-wj7p) - GitHub
- [GHSA-pxmg-gr7p-wx8p - def-open-client malware advisory](https://github.com/advisories/GHSA-pxmg-gr7p-wx8p) - GitHub
- [GHSA-vw26-8qc4-8hmg - @zannstore/baileys malware advisory](https://github.com/advisories/GHSA-vw26-8qc4-8hmg) - GitHub
- [GHSA-x4cm-7r6h-pjg3 - @omniwatch-wick/cli malware advisory](https://github.com/advisories/GHSA-x4cm-7r6h-pjg3) - GitHub
- [GHSA-qccg-fq42-3rgc - @finxsecdemo/utils malware advisory](https://github.com/advisories/GHSA-qccg-fq42-3rgc) - GitHub
- [GHSA-frrq-7m67-mgxg - zer0code malware advisory](https://github.com/advisories/GHSA-frrq-7m67-mgxg) - GitHub
- [GHSA-wwp4-2j5x-f2m9 - flight-compare-analyzer malware advisory](https://github.com/advisories/GHSA-wwp4-2j5x-f2m9) - GitHub
- [GHSA-qw86-6hcg-cj2j - test-skill-zip malware advisory](https://github.com/advisories/GHSA-qw86-6hcg-cj2j) - GitHub
- [GHSA-fh6v-xfxj-m87q - feedback-ai-sdk malware advisory](https://github.com/advisories/GHSA-fh6v-xfxj-m87q) - GitHub
- [GHSA-2p2c-gx9p-5wg8 - open-worker-cli malware advisory](https://github.com/advisories/GHSA-2p2c-gx9p-5wg8) - GitHub
- [GHSA-vw6q-xg53-fpxh - data-parser-utils malware advisory](https://github.com/advisories/GHSA-vw6q-xg53-fpxh) - GitHub
- [GHSA-73c6-pgjj-9v82 - eslintcmd malware advisory](https://github.com/advisories/GHSA-73c6-pgjj-9v82) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-30-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-30-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).