# GitHub Advisory npm CWE-506 sweep - 91-package 2026-07-30/07-31 batch (`@peptide-packets` biotech scope pair, socket.io/mongoose/passport typosquat burst, ethers.js/rlp/fs-extra impersonator kit, `nano-perf` postinstall daemon C2, late-07-31 MCP-namespace burst, `@0xlr` dep-confusion PoC scope, `@spending-behavior-ui`/`@finance-ui`/`@mplay-*`/`@sof-assistant-*` enterprise dep-confusion sweep, `rollup-plugin-polyfill-hold`/`-helper` pair, `paraglide-js@1.0.1` takeover-style drop)

> GHSA published 91 npm CWE-506 advisories 2026-07-30–07-31: existing 25-pkg batch (`@peptide-packets`, socket.io/mongoose/passport typos, ethers/rlp/fs-extra, `nano-perf` C2) plus a late-07-31 66-pkg wave - MCP-namespace burst (13), `@0xlr` dep-confusion PoC scope (10), enterprise internal-scope dep-confusion sweep (15 scoped pkgs), broad unscoped typosquats (25), `rollup-plugin-polyfill-hold`/`-helper` pair, `paraglide-js@1.0.1` takeover.

- Published: 2026-07-31
- Last updated: 2026-08-01
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 92 packages, 92 compromised versions
- Tags: typosquat, crypto-wallet-drain, credential-theft, infostealer, dependency-confusion, ci-cd-compromise, obfuscation
- Also known as: 2026-07-30/07-31 GHSA npm batch, @peptide-packets operator continuation, socket.io/mongoose/passport typosquat burst, ethers.js/rlp/fs-extra impersonator kit, late-07-31 MCP-namespace burst, @0xlr dep-confusion PoC scope, enterprise internal-scope dep-confusion sweep 2026-07-31, paraglide-js 1.0.1 takeover
- Detected by: GitHub Advisory Database, npm Security
- Incident ID: npm-2026-07-31-ghsa-malware-sweep

## Affected packages (92)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@0xlr/clerk-auth](https://dependencywatch.io/package/npm/@0xlr/clerk-auth) | npm | 1.0.0 |
| [@0xlr/dep-confusion-poc](https://dependencywatch.io/package/npm/@0xlr/dep-confusion-poc) | npm | 1.0.0 |
| [@0xlr/prisma-client-js](https://dependencywatch.io/package/npm/@0xlr/prisma-client-js) | npm | 1.0.0 |
| [@0xlr/question-types](https://dependencywatch.io/package/npm/@0xlr/question-types) | npm | 1.0.0 |
| [@0xlr/sentry-web](https://dependencywatch.io/package/npm/@0xlr/sentry-web) | npm | 1.0.0 |
| [@0xlr/stripe-checkout-js](https://dependencywatch.io/package/npm/@0xlr/stripe-checkout-js) | npm | 1.0.0 |
| [@0xlr/stripe-frontend](https://dependencywatch.io/package/npm/@0xlr/stripe-frontend) | npm | 1.0.0 |
| [@0xlr/supabase-db](https://dependencywatch.io/package/npm/@0xlr/supabase-db) | npm | 1.0.0 |
| [@0xlr/test-callback](https://dependencywatch.io/package/npm/@0xlr/test-callback) | npm | 1.0.0 |
| [@0xlr/vercel-analytics](https://dependencywatch.io/package/npm/@0xlr/vercel-analytics) | npm | 1.0.0 |
| [@404c3s4r/lodash](https://dependencywatch.io/package/npm/@404c3s4r/lodash) | npm | 1.0.0 |
| [@cr-invested-ui-components/chart](https://dependencywatch.io/package/npm/@cr-invested-ui-components/chart) | npm | 1.0.0 |
| [@dexwilt/node-fetch](https://dependencywatch.io/package/npm/@dexwilt/node-fetch) | npm | 2.7.3 |
| [@finance-ui/finance-view](https://dependencywatch.io/package/npm/@finance-ui/finance-view) | npm | 1.0.0 |
| [@finance-ui/snackbar-ifpe](https://dependencywatch.io/package/npm/@finance-ui/snackbar-ifpe) | npm | 1.0.0 |
| [@fuji-web-components/maps](https://dependencywatch.io/package/npm/@fuji-web-components/maps) | npm | 1.0.0 |
| [@global-theme/context](https://dependencywatch.io/package/npm/@global-theme/context) | npm | 1.0.0 |
| [@meli-testing/jest-react](https://dependencywatch.io/package/npm/@meli-testing/jest-react) | npm | 1.0.0 |
| [@mp-op-ss-front-lib/tracks](https://dependencywatch.io/package/npm/@mp-op-ss-front-lib/tracks) | npm | 1.0.0 |
| [@mplay-core-lib/utilities](https://dependencywatch.io/package/npm/@mplay-core-lib/utilities) | npm | 1.0.0 |
| [@mplay-frontend-ui/link](https://dependencywatch.io/package/npm/@mplay-frontend-ui/link) | npm | 1.0.0 |
| [@nordic-dev/linting-tools](https://dependencywatch.io/package/npm/@nordic-dev/linting-tools) | npm | 1.0.0 |
| [@one-chat/react](https://dependencywatch.io/package/npm/@one-chat/react) | npm | 1.0.0 |
| [@peptide-packets/js-unimode](https://dependencywatch.io/package/npm/@peptide-packets/js-unimode) | npm | 1.0.0 |
| [@peptide-packets/peptide-modify](https://dependencywatch.io/package/npm/@peptide-packets/peptide-modify) | npm | 1.0.0 |
| [@sof-assistant-fe-lib/vertical-faqs](https://dependencywatch.io/package/npm/@sof-assistant-fe-lib/vertical-faqs) | npm | 1.0.0 |
| [@spending-behavior-ui/cashflow-widget](https://dependencywatch.io/package/npm/@spending-behavior-ui/cashflow-widget) | npm | 1.0.0 |
| [@spending-behavior-ui/widget-insights](https://dependencywatch.io/package/npm/@spending-behavior-ui/widget-insights) | npm | 1.0.0 |
| [@sudoughnym/enviro-demo](https://dependencywatch.io/package/npm/@sudoughnym/enviro-demo) | npm | 1.0.0 |
| [@sw-commons-components/message-upsell](https://dependencywatch.io/package/npm/@sw-commons-components/message-upsell) | npm | 1.0.0 |
| [adpanel-core](https://dependencywatch.io/package/npm/adpanel-core) | npm | 1.0.0 |
| [ai-backup-script](https://dependencywatch.io/package/npm/ai-backup-script) | npm | 1.0.0 |
| [allurectl](https://dependencywatch.io/package/npm/allurectl) | npm | 1.0.0 |
| [asdsafsadad](https://dependencywatch.io/package/npm/asdsafsadad) | npm | 1.0.0 |
| [asdsafsafdasdsaasdasda](https://dependencywatch.io/package/npm/asdsafsafdasdsaasdasda) | npm | 1.0.0 |
| [attio-discover](https://dependencywatch.io/package/npm/attio-discover) | npm | 1.0.0 |
| [capacitor-assets](https://dependencywatch.io/package/npm/capacitor-assets) | npm | 1.0.0 |
| [chaos-mcp](https://dependencywatch.io/package/npm/chaos-mcp) | npm | 1.0.0 |
| [community-published](https://dependencywatch.io/package/npm/community-published) | npm | 1.0.0 |
| [create-remotion](https://dependencywatch.io/package/npm/create-remotion) | npm | 1.0.0 |
| [eth-bridge](https://dependencywatch.io/package/npm/eth-bridge) | npm | 1.0.0 |
| [ethe.json](https://dependencywatch.io/package/npm/ethe.json) | npm | 1.0.0 |
| [ethers.json](https://dependencywatch.io/package/npm/ethers.json) | npm | 1.0.0 |
| [ethersss](https://dependencywatch.io/package/npm/ethersss) | npm | 1.0.0 |
| [fast-csv-helper](https://dependencywatch.io/package/npm/fast-csv-helper) | npm | 1.0.0 |
| [frontend-regulations](https://dependencywatch.io/package/npm/frontend-regulations) | npm | 1.0.0 |
| [fs-extra-master](https://dependencywatch.io/package/npm/fs-extra-master) | npm | 1.0.0 |
| [fsextrra](https://dependencywatch.io/package/npm/fsextrra) | npm | 1.0.0 |
| [goldenflow-js](https://dependencywatch.io/package/npm/goldenflow-js) | npm | 1.0.0 |
| [gtm-mcp-auth](https://dependencywatch.io/package/npm/gtm-mcp-auth) | npm | 1.0.0 |
| [hazmat-cfr](https://dependencywatch.io/package/npm/hazmat-cfr) | npm | 1.0.0 |
| [hit-mcp](https://dependencywatch.io/package/npm/hit-mcp) | npm | 1.0.0 |
| [iac-scanner](https://dependencywatch.io/package/npm/iac-scanner) | npm | 1.0.0 |
| [install-native-host](https://dependencywatch.io/package/npm/install-native-host) | npm | 1.0.0 |
| [iwomm-mcp](https://dependencywatch.io/package/npm/iwomm-mcp) | npm | 1.0.0 |
| [kelly-stake](https://dependencywatch.io/package/npm/kelly-stake) | npm | 1.0.0 |
| [kip-mcp-http](https://dependencywatch.io/package/npm/kip-mcp-http) | npm | 1.0.0 |
| [maximumsats-mcp](https://dependencywatch.io/package/npm/maximumsats-mcp) | npm | 1.0.0 |
| [mcp-server-boilerplate](https://dependencywatch.io/package/npm/mcp-server-boilerplate) | npm | 1.0.0 |
| [metrics-ui](https://dependencywatch.io/package/npm/metrics-ui) | npm | 1.0.0 |
| [mongostose](https://dependencywatch.io/package/npm/mongostose) | npm | 1.0.0 |
| [moontose](https://dependencywatch.io/package/npm/moontose) | npm | 1.0.0 |
| [nano-perf](https://dependencywatch.io/package/npm/nano-perf) | npm | 2.2.0 |
| [node-fs-extra-master](https://dependencywatch.io/package/npm/node-fs-extra-master) | npm | 1.0.0 |
| [notifications-broadcast](https://dependencywatch.io/package/npm/notifications-broadcast) | npm | 1.0.0 |
| [paraglide-js](https://dependencywatch.io/package/npm/paraglide-js) | npm | 1.0.1 |
| [passsport1](https://dependencywatch.io/package/npm/passsport1) | npm | 1.0.0 |
| [passtpor](https://dependencywatch.io/package/npm/passtpor) | npm | 1.0.0 |
| [pm-claude-skills-mcp](https://dependencywatch.io/package/npm/pm-claude-skills-mcp) | npm | 1.0.0 |
| [polylabel-web-lib](https://dependencywatch.io/package/npm/polylabel-web-lib) | npm | 1.0.0 |
| [polyprompt](https://dependencywatch.io/package/npm/polyprompt) | npm | 1.0.0 |
| [portway](https://dependencywatch.io/package/npm/portway) | npm | 1.0.0 |
| [process-status-widget](https://dependencywatch.io/package/npm/process-status-widget) | npm | 1.0.0 |
| [react-hot-svg](https://dependencywatch.io/package/npm/react-hot-svg) | npm | 1.0.0 |
| [redis-type-xyz](https://dependencywatch.io/package/npm/redis-type-xyz) | npm | 1.10.6 |
| [refbase-mcp](https://dependencywatch.io/package/npm/refbase-mcp) | npm | 1.0.0 |
| [rlp-master](https://dependencywatch.io/package/npm/rlp-master) | npm | 1.0.0 |
| [rlp.git](https://dependencywatch.io/package/npm/rlp.git) | npm | 1.0.0 |
| [rollup-plugin-polyfill-helper](https://dependencywatch.io/package/npm/rollup-plugin-polyfill-helper) | npm | 1.0.0 |
| [rollup-plugin-polyfill-hold](https://dependencywatch.io/package/npm/rollup-plugin-polyfill-hold) | npm | 1.0.0 |
| [routerbase-mcp](https://dependencywatch.io/package/npm/routerbase-mcp) | npm | 1.0.0 |
| [sap-mcp-config](https://dependencywatch.io/package/npm/sap-mcp-config) | npm | 1.0.0 |
| [sap-mcp-facilitator](https://dependencywatch.io/package/npm/sap-mcp-facilitator) | npm | 1.0.0 |
| [scketio](https://dependencywatch.io/package/npm/scketio) | npm | 1.0.0 |
| [smart-npv-mcp](https://dependencywatch.io/package/npm/smart-npv-mcp) | npm | 1.0.0 |
| [soccketio](https://dependencywatch.io/package/npm/soccketio) | npm | 1.0.0 |
| [socketi](https://dependencywatch.io/package/npm/socketi) | npm | 1.0.0 |
| [socktio](https://dependencywatch.io/package/npm/socktio) | npm | 1.0.0 |
| [sso-users-detection](https://dependencywatch.io/package/npm/sso-users-detection) | npm | 1.0.0 |
| [vcse](https://dependencywatch.io/package/npm/vcse) | npm | 1.0.0 |
| [vite-config-svg](https://dependencywatch.io/package/npm/vite-config-svg) | npm | 1.0.0 |
| [vite-tsconfig-svg](https://dependencywatch.io/package/npm/vite-tsconfig-svg) | npm | 1.0.0 |

## What happened

On 2026-07-30 and 2026-07-31, the GitHub Advisory Database published **91 new npm CWE-506 (Embedded Malicious Code) advisories** - 8 dated 2026-07-30 and 83 dated 2026-07-31. This module was originally catalogued with the first-25 subset visible at yesterday's ingest snapshot; the 2026-08-01 update adds the additional **66 late-07-31 packages** that landed after the previous ingest ran, grouped into five new clusters E–I.

Clear operator-cluster structure across nine thematic groups plus a scatter of single-package RATs indicates a wave of coordinated multi-package campaigns rather than 91 unrelated typosquats. The late-07-31 wave in particular reads as **a single burst of orchestrated dep-confusion / typosquat activity** targeting: (a) the MCP-server namespace (Anthropic MCP tooling), (b) enterprise internal-scope namespaces at multiple large organisations, and (c) the modern SaaS-integration stack (Sentry / Prisma / Vercel Analytics / Stripe / Clerk / Supabase - via the `@0xlr` PoC scope).

## Cluster A - `@peptide-packets/*` operator-continuation of `@peptide-unit` (2 packages, all `>= 0`, all 2026-07-31)

| Package | Notes |
|---|---|
| `@peptide-packets/peptide-modify` | identical name to `@peptide-unit/peptide-modify` (07-29) |
| `@peptide-packets/js-unimode` | identical name to `@peptide-unit/js-unimode` (07-29) |

This is a **direct operator continuation** of the 2026-07-29 `@peptide-unit` pair catalogued in `npm-2026-07-30-ghsa-malware-sweep` Cluster C. The two package names - `peptide-modify` (a plausibly-domain-specific peptide-analysis tool) paired with the nonsense-name `js-unimode` - are identical between the two scopes. Two publishes 48h apart under different attacker-owned scopes with the same package-name pair is unambiguously the same operator continuing to enumerate the internal-library namespace of a peptide-analysis / biotech target. This is the second recurrence of a dep-confusion probe against the same biotech target namespace - treat every `@peptide-*` scope as attacker-controlled until proven otherwise.

## Cluster B - socket.io / mongoose / passport typosquat burst (8 packages, all `>= 0`, all 2026-07-31)

| Package | Legitimate target |
|---|---|
| `socketi` | `socket.io` |
| `soccketio` | `socket.io` |
| `socktio` | `socket.io` |
| `scketio` | `socket.io` |
| `mongostose` | `mongoose` |
| `moontose` | `mongoose` |
| `passsport1` | `passport` |
| `passtpor` | `passport` |

Same-day publish across 8 typosquats of three of the most-installed npm packages. Socket.IO / Mongoose / Passport together dominate the Node.js real-time / DB / auth stack for tutorial-driven Express codebases - the exact class of app where a paste-error from a tutorial or an ChatGPT-generated snippet delivers a lockfile hit. Coordinated broad-scatter typosquat kit rather than targeted operation.

## Cluster C - ethers.js / rlp / fs-extra impersonator kit (8 packages, all `>= 0`, all 2026-07-30)

| Package | Legitimate target |
|---|---|
| `ethe.json` | `ethers` (v6 JSON-RPC provider) |
| `ethers.json` | `ethers` (v6 JSON-RPC provider) |
| `ethersss` | `ethers` |
| `rlp.git` | `rlp` (Recursive-Length-Prefix, Ethereum wire encoding) |
| `rlp-master` | `rlp` |
| `fsextrra` | `fs-extra` |
| `fs-extra-master` | `fs-extra` |
| `node-fs-extra-master` | `fs-extra` |

The ethers + rlp co-occurrence points at Ethereum wallet / dApp developer targeting - `rlp` is a niche low-level Ethereum encoding library that only Ethereum-tooling developers pull in directly, and paired with `ethers` typosquats in the same batch it is a coordinated wallet-drainer kit. Same operator profile as the earlier 2026-06 `polymarket-clob-math-vercel-loader` and 2026-06 `ts-einkle-ankle-wallet-cluster` campaigns targeting Ethereum-tooling developer namespaces.

The `fs-extra` cluster in the same batch is more generic - `fs-extra` is a universal Node.js filesystem-utility (>50M weekly downloads) - but the `-master` suffix pattern (`rlp-master`, `fs-extra-master`, `node-fs-extra-master`) suggests all three came out of the same attacker-controlled fork-repository-naming template.

## Cluster D - misc single-package RATs and exact-version drops (7 packages, 2026-07-31 unless noted)

| Package | Version | Notes |
|---|---|---|
| `nano-perf` | `2.2.0` | postinstall script launches `daemon.js` as detached unreferenced process for covert C2 - **targeted exact-version drop** |
| `redis-type-xyz` | `1.10.6` | exact-version drop, Redis-type-annotation impersonation |
| `@dexwilt/node-fetch` | `2.7.3` | attacker-scoped `node-fetch` typosquat - legitimate `node-fetch@2.7.0` is the current v2 line so `2.7.3` pins to catch upgrade-path resolution |
| `@sudoughnym/enviro-demo` | all | scoped "environment demo" - generic RAT boilerplate |
| `vcse` | all | generic-name upload |
| `asdsafsadad` | all | junk-name upload, likely researcher / red-team test |
| `asdsafsafdasdsaasdasda` | all | junk-name upload, likely researcher / red-team test |

High-signal picks: `nano-perf@2.2.0` is the standout - the GHSA advisory explicitly notes a postinstall script that launches `daemon.js` as a **detached, unreferenced process**, meaning a `postinstall` C2 handshake that survives the CI job that installed it. `redis-type-xyz@1.10.6` and `@dexwilt/node-fetch@2.7.3` are exact-version drops (rather than the more common all-versions typosquat) - the operator wants specific-version dependency-graph hits, not broad scatter.

The two `asd…` junk-name entries are almost certainly researcher / red-team test uploads left in the wild, but GHSA flagged them CWE-506 and they are catalogued here for completeness - a lockfile hit on either name is still an incident (either genuine malware or an unauthorised test).

## Cluster E - MCP-namespace typosquat / impersonator wave (13 packages, all 2026-07-31, added 2026-08-01)

| Package | Notes |
|---|---|
| `refbase-mcp` | MCP-server namespace |
| `hit-mcp` | MCP-server namespace |
| `mcp-server-boilerplate` | high-signal generic-name land-grab |
| `iwomm-mcp` | MCP-server namespace |
| `chaos-mcp` | chaos-engineering + MCP fusion name |
| `gtm-mcp-auth` | GTM (Google Tag Manager) MCP-auth impersonator |
| `sap-mcp-facilitator` | SAP MCP integration namespace |
| `sap-mcp-config` | SAP MCP integration namespace |
| `maximumsats-mcp` | domain-specific MCP namespace |
| `kip-mcp-http` | KIP MCP HTTP transport |
| `pm-claude-skills-mcp` | **Claude Skills MCP integration** - targeted at Anthropic Claude Skills users |
| `smart-npv-mcp` | domain-specific MCP namespace |
| `routerbase-mcp` | MCP-server namespace |

Coordinated same-day burst against the Model Context Protocol namespace. Anthropic MCP tooling is the fastest-growing package category in npm and every mid-2026 GHSA batch has featured MCP-namespace typosquats. `pm-claude-skills-mcp` explicitly targets Claude Skills users - the operator is enumerating MCP-adjacent product-namespace real estate broadly. The generic `mcp-server-boilerplate` name is a namespace land-grab against a common project-scaffolding search phrase.

## Cluster F - `@0xlr`/`@404c3s4r` scoped researcher/red-team PoC batch (11 packages, all 2026-07-31, added 2026-08-01)

| Package | Notes |
|---|---|
| `@0xlr/dep-confusion-poc` | **smoking-gun name - literal PoC declaration** |
| `@0xlr/sentry-web` | Sentry error-tracking dep-confusion probe |
| `@0xlr/prisma-client-js` | Prisma ORM dep-confusion probe |
| `@0xlr/vercel-analytics` | Vercel Analytics dep-confusion probe |
| `@0xlr/stripe-checkout-js` | Stripe SDK dep-confusion probe |
| `@0xlr/stripe-frontend` | Stripe SDK dep-confusion probe |
| `@0xlr/clerk-auth` | Clerk auth SDK dep-confusion probe |
| `@0xlr/supabase-db` | Supabase DB SDK dep-confusion probe |
| `@0xlr/test-callback` | generic test / callback probe |
| `@0xlr/question-types` | generic probe |
| `@404c3s4r/lodash` | lodash impersonator on separate attacker scope |

Every name in the `@0xlr` scope is a plausible enterprise dep-confusion target across the modern SaaS integration stack (Sentry / Prisma / Vercel Analytics / Stripe / Clerk / Supabase). The literal `dep-confusion-poc` sibling name outs this as almost-certainly a red-team / security-researcher enumeration exercise rather than a criminal operation - but GHSA flagged all 11 as CWE-506 and they are catalogued here for completeness. A lockfile hit is still an incident (either genuine malware or an unauthorised researcher upload with the same on-install exfil footprint), and the naming pattern is a useful lesson in how the enterprise-integration stack namespace is enumerable.

## Cluster G - enterprise internal-scope dep-confusion sweep (15 packages, all 2026-07-31, added 2026-08-01)

| Package | Notes |
|---|---|
| `@spending-behavior-ui/widget-insights` | fintech-analytics scope |
| `@spending-behavior-ui/cashflow-widget` | fintech-analytics scope |
| `@finance-ui/finance-view` | fintech scope |
| `@finance-ui/snackbar-ifpe` | fintech scope (IFPE = Instituición de Fondos de Pago Electrónico - Mexican fintech regulator) |
| `@nordic-dev/linting-tools` | Nordic-region dev tooling scope |
| `@fuji-web-components/maps` | Fuji web-components scope |
| `@meli-testing/jest-react` | MercadoLibre (meli) testing scope |
| `@sw-commons-components/message-upsell` | "sw" internal scope |
| `@mplay-core-lib/utilities` | mplay-* scope, possibly a media-player enterprise |
| `@mplay-frontend-ui/link` | mplay-* scope |
| `@global-theme/context` | design-system scope |
| `@one-chat/react` | chat product scope |
| `@sof-assistant-fe-lib/vertical-faqs` | SoF assistant frontend scope |
| `@mp-op-ss-front-lib/tracks` | mp-op-ss internal scope |
| `@cr-invested-ui-components/chart` | Crédito Real / CR-Invested UI scope |

All 15 packages follow the canonical `@<internal-org-scope>/<internal-package-name>` dep-confusion probe pattern. The scope-name distinctness (5–10 different enterprises implied) means this is a **broad enumeration campaign** against multiple large orgs - the attacker publishes plausible internal-package-name shape into the public npm scope namespace on the bet that at least one target org has misconfigured `.npmrc` `always-auth` + scope-to-registry mapping. The `@finance-ui/snackbar-ifpe` name (IFPE is a Mexican fintech regulator) and `@meli-testing/jest-react` (MercadoLibre) suggest a Latin-American fintech / marketplace target concentration in this batch.

## Cluster H - broad-scatter unscoped dep-confusion / typosquats (25 packages, all 2026-07-31, added 2026-08-01)

| Package | Notes |
|---|---|
| `paraglide-js` (`1.0.1`) | typosquat / squat against the legit paraglide-js i18n library - `1.0.1` version pin catches tutorial / example refs |
| `create-remotion` | Remotion video-tooling namespace (`create-*` scaffold-name land-grab) |
| `capacitor-assets` | Capacitor mobile-tooling namespace (legit `@capacitor/assets` exists) |
| `fast-csv-helper` | fast-csv typosquat (dominant CSV parser, 4M weekly downloads) |
| `vite-tsconfig-svg` / `vite-config-svg` / `react-hot-svg` | Vite plugin / React tooling namespace |
| `polyprompt`, `goldenflow-js`, `install-native-host`, `ai-backup-script`, `iac-scanner` | generic-sounding tool names |
| `eth-bridge`, `kelly-stake` | crypto-adjacent generic names |
| `frontend-regulations`, `metrics-ui`, `sso-users-detection`, `notifications-broadcast`, `portway`, `allurectl`, `adpanel-core`, `hazmat-cfr`, `attio-discover` | enterprise-app-sounding internal-name shape |
| `community-published`, `process-status-widget`, `polylabel-web-lib` | misc |

This unscoped subset is the wide-net counterpart to Cluster G - same operator pattern (plausible internal package names) but on the unscoped part of the npm namespace where any org that pushed internal libraries without scoping is exposed. `paraglide-js@1.0.1` is a namespace-adjacent takeover attempt on the legitimate paraglide-js i18n library.

## Cluster I - `rollup-plugin-polyfill-*` pair (2 packages, both 2026-07-31, added 2026-08-01)

| Package | Notes |
|---|---|
| `rollup-plugin-polyfill-hold` | `rollup-plugin-polyfill-*` namespace |
| `rollup-plugin-polyfill-helper` | `rollup-plugin-polyfill-*` namespace |

Echoes the earlier `npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie` DPRK Lazarus / OtterCookie campaign that targeted the same `rollup-plugin-polyfill-*` naming template. These two 07-31 entries carry only the generic CWE-506 boilerplate with no explicit actor attribution - treat as adjacent to the earlier Lazarus wave until a researcher writeup (JFrog / ReversingLabs / Socket / Wiz) explicitly attributes.

## Registry state

All 91 packages security-replaced during the 2026-07-30 / 07-31 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Cluster A directly extends the 07-29 `@peptide-unit/*` pair catalogued in `npm-2026-07-30-ghsa-malware-sweep` Cluster C - same operator, new scope.
- Cluster C extends the operator space around `npm-2026-07-08-injectivelabs-sdk-ts-crypto-wallet-drain`, `npm-2026-06-27-ts-einkle-ankle-wallet-cluster`, and `npm-2026-06-27-polymarket-clob-math-vercel-loader` - all targeting Ethereum-tooling developer namespaces.
- `nano-perf@2.2.0` postinstall-daemon pattern echoes `npm-2026-06-18-nastyc2-rust-implant-droppers` and the earlier `npm-2026-04-15-kindo-selfbot-xworm` postinstall-C2 handshake patterns.
- **Cluster E** (MCP-namespace burst) extends the mid-2026 MCP-typosquat trend - see `npm-2026-07-30-ghsa-malware-sweep` and `multi-2026-04-29-promptmink-validate-sdk`. Companion PyPI-side MCP activity in `pypi-2026-07-31-ghsa-malware-sweep` Cluster C (`mcp-search-server`).
- **Cluster G** (internal-scope dep-confusion) extends the same operator pattern catalogued in `npm-2026-06-29-internal-scope-dep-confusion-cluster` and `pypi-2026-07-21-ghsa-mass-backfill`.
- **Cluster I** (`rollup-plugin-polyfill-*` pair) is a plausible extension of `npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie` (DPRK Lazarus / OtterCookie), pending explicit vendor attribution.
- No `threatActor` field is set - GHSA advisories in this batch use only the CWE-506 boilerplate with no named actor attribution. Cluster F reads as a red-team/researcher exercise but is unattributed.

## Impact

- Any host that installed any of the 91 npm packages listed below should be treated as fully compromised - every GHSA record uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
- **Cluster A - `@peptide-packets/*` biotech scope pair, operator-continuation of `@peptide-unit`** (2 packages, all `>= 0`, all 2026-07-31): `@peptide-packets/peptide-modify`, `@peptide-packets/js-unimode`. These are **identical siblings** to the 2026-07-29 `@peptide-unit/peptide-modify` + `@peptide-unit/js-unimode` pair catalogued in `npm-2026-07-30-ghsa-malware-sweep` - same nonsense `js-unimode` paired with same `peptide-modify` name, but under a new attacker-controlled scope. Two publishes 48h apart under different scopes with the same package-name pair is unambiguously the same operator continuing to enumerate the internal-library namespace of a peptide-analysis / biotech target
- **Cluster B - socket.io / mongoose / passport typosquat burst** (8 packages, all `>= 0`, all 2026-07-31): `socketi`, `soccketio`, `socktio`, `scketio` (`socket.io` typos), `mongostose`, `moontose` (`mongoose` typos), `passsport1`, `passtpor` (`passport` typos). Same-day publish across 8 typosquats of three of the most-installed npm packages (Socket.IO >4M weekly, Mongoose >3M weekly, Passport >2M weekly) - coordinated broad-scatter typosquat kit rather than targeted operation
- **Cluster C - ethers.js / rlp / fs-extra impersonator kit** (8 packages, all `>= 0`, all 2026-07-30): `ethe.json`, `ethers.json`, `ethersss` (`ethers` typos, Ethereum wallet interaction library), `rlp.git`, `rlp-master` (`rlp` typos - Recursive-Length-Prefix, Ethereum wire-format encoding), `fsextrra`, `fs-extra-master`, `node-fs-extra-master` (`fs-extra` typos). The ethers + rlp co-occurrence points at Ethereum wallet / dApp developer targeting - same operator profile as the 07-31 socket.io burst and prior `@ts-einkle-ankle-wallet-cluster` / `polymarket-clob-math-vercel-loader` campaigns
- **Cluster D - misc single-package RATs and exact-version drops** (7 packages, mostly 2026-07-31): `nano-perf@2.2.0` (postinstall script launches `daemon.js` as detached unreferenced process for covert C2 - targeted exact-version drop), `redis-type-xyz@1.10.6` (exact-version drop, Redis-type-annotation impersonation), `@dexwilt/node-fetch@2.7.3` (attacker-scoped `node-fetch` typosquat - legitimate `node-fetch@2.7.0` is the current v2 line so 2.7.3 pins to catch upgrade-path resolution), `@sudoughnym/enviro-demo`, `vcse`, plus two obvious junk-name uploads (`asdsafsadad`, `asdsafsafdasdsaasdasda` - likely researcher / red-team test uploads, but GHSA flagged malware so catalogued for completeness)
- **Cluster E - MCP-namespace typosquat / impersonator wave (added 2026-08-01)** (13 packages, all 2026-07-31): `refbase-mcp`, `hit-mcp`, `mcp-server-boilerplate`, `iwomm-mcp`, `chaos-mcp`, `gtm-mcp-auth`, `sap-mcp-facilitator`, `maximumsats-mcp`, `sap-mcp-config`, `kip-mcp-http`, `pm-claude-skills-mcp`, `smart-npv-mcp`, `routerbase-mcp`. Coordinated same-day burst against the Model Context Protocol namespace - Anthropic MCP-server tooling is the fastest-growing package category in npm and every mid-2026 GHSA batch has featured MCP typosquats. `pm-claude-skills-mcp` explicitly targets Claude-Skills-namespace developer workflows
- **Cluster F - `@0xlr`/`@404c3s4r` scoped researcher/red-team PoC batch (added 2026-08-01)** (11 packages, all 2026-07-31): `@0xlr/dep-confusion-poc` (name is the smoking-gun - literal "PoC" declaration), `@0xlr/sentry-web`, `@0xlr/prisma-client-js`, `@0xlr/vercel-analytics`, `@0xlr/stripe-checkout-js`, `@0xlr/test-callback`, `@0xlr/clerk-auth`, `@0xlr/question-types`, `@0xlr/stripe-frontend`, `@0xlr/supabase-db`, `@404c3s4r/lodash`. Every name in the `@0xlr` scope is a plausible enterprise dep-confusion target (Sentry / Prisma / Vercel Analytics / Stripe / Clerk / Supabase - the modern SaaS stack) - this reads as a red-team / security-researcher enumeration exercise, but GHSA flagged all 11 as CWE-506 and they are catalogued for completeness. A lockfile hit is still an incident (either genuine malware or an unauthorised researcher upload)
- **Cluster G - enterprise internal-scope dep-confusion sweep (added 2026-08-01)** (15 packages, all 2026-07-31): `@spending-behavior-ui/widget-insights`, `@spending-behavior-ui/cashflow-widget`, `@finance-ui/finance-view`, `@finance-ui/snackbar-ifpe` (fintech UI namespace - Mercado Pago / Nubank / similar Latin-American fintech target profile), `@nordic-dev/linting-tools`, `@fuji-web-components/maps`, `@meli-testing/jest-react` (MercadoLibre), `@sw-commons-components/message-upsell`, `@mplay-core-lib/utilities`, `@mplay-frontend-ui/link`, `@global-theme/context`, `@one-chat/react`, `@sof-assistant-fe-lib/vertical-faqs`, `@mp-op-ss-front-lib/tracks`, `@cr-invested-ui-components/chart`. All 15 are `@<internal-org-scope>/<internal-package-name>` shape - canonical dep-confusion probe pattern targeting the internal-library namespaces of 5–10 large enterprises (based on the scope-name distinctness). Any lockfile hit means the target org's private-scope resolution fell through to the public registry
- **Cluster H - broad-scatter unscoped dep-confusion / typosquats (added 2026-08-01)** (25 packages, all 2026-07-31): `paraglide-js@1.0.1` (typosquat of the legitimate paraglide-js i18n library - the `1.0.1` version pin is designed to land on tutorials or examples referencing v1), `create-remotion` (Remotion video-tooling namespace), `capacitor-assets` (Capacitor mobile-tooling namespace - legit `@capacitor/assets` exists), `paraglide-js`, `fast-csv-helper` (fast-csv typosquat), `vite-tsconfig-svg`, `react-hot-svg`, `vite-config-svg` (vite plugin-namespace typosquats), `polyprompt`, `goldenflow-js`, `install-native-host`, `ai-backup-script`, `iac-scanner`, `eth-bridge`, `kelly-stake`, `frontend-regulations`, `metrics-ui`, `sso-users-detection`, `notifications-broadcast`, `portway`, `allurectl` (Allure testing tooling), `adpanel-core`, `hazmat-cfr`, `attio-discover`, `community-published`, `process-status-widget`, `polylabel-web-lib`
- **Cluster I - `rollup-plugin-polyfill-*` pair (added 2026-08-01)** (2 packages, both 2026-07-31): `rollup-plugin-polyfill-hold`, `rollup-plugin-polyfill-helper`. Echoes the earlier `npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie` DPRK campaign - same `rollup-plugin-polyfill-*` naming template used by DPRK Lazarus / OtterCookie operators, though these two carry only the generic CWE-506 boilerplate with no explicit actor attribution. Treat as adjacent to the earlier Lazarus rollup-polyfill wave until researcher writeups confirm otherwise
- None of the 91 packages retain original tarballs on the public npm registry - all replaced with security sentinels during takedown. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **Cluster C (ethers.js / rlp / fs-extra kit)**: any hit on any of the 8 packages on a host that runs Ethereum wallet software, dApp code, or holds signing keys: treat as full crypto-wallet-compromise event. Move funds via a clean device BEFORE attempting rotation. Rotate every dev-wallet seed phrase, MetaMask account, and hardware-wallet PIN accessible from the affected host
3. **Cluster B (socket.io/mongoose/passport typosquat burst)**: fix the misspelling in `package.json` before re-installing - a typo hit is often a paste error from a tutorial or ChatGPT-generated snippet. Rotate any session-signing secrets, MongoDB connection strings, and OAuth client secrets that the compromised app touched
4. **Cluster A (`@peptide-packets/*`)**: configure `.npmrc` scope-to-registry mapping so private-scope resolution never falls through to the public registry. Also add `@peptide-unit` to the same allow-list - same operator, same target namespace
5. **Cluster D single-package hits**: `nano-perf@2.2.0` and `redis-type-xyz@1.10.6` are exact-version drops - targeted rather than broad scatter. If either hits your lockfile, treat the build host as compromised and audit outbound network for the daemon.js C2 channel. `@dexwilt/node-fetch@2.7.3` targets developers on the v2 line - pin to the legitimate `node-fetch@^2.7.0` from `github.com/node-fetch/node-fetch` and verify the resolved integrity hash
6. For projects using `postinstall`-scripting packages, run `npm install --ignore-scripts` in CI as defense-in-depth - `nano-perf@2.2.0` demonstrates that a postinstall-launched detached daemon can survive the CI job that installed it
7. **Clusters E–I (added 2026-08-01)**: for MCP-namespace typosquats (Cluster E) - audit any developer machine running Model-Context-Protocol server tooling and pin MCP dependencies via `overrides` in `package.json` to trusted registry paths. For `@0xlr`/`@404c3s4r` (Cluster F) - treat any hit as an incident regardless of researcher-vs-genuine origin; unauthorised researcher uploads still exfiltrate on install. For internal-scope dep-confusion (Cluster G) - every organisation should audit their `.npmrc` `always-auth` + scope-to-registry mappings for `@spending-behavior-ui`, `@finance-ui`, `@mplay-*`, `@sof-assistant-*`, `@sw-commons-components`, `@meli-testing`, `@mp-op-ss-front-lib`, `@cr-invested-ui-components` - a public-registry fall-through resolves the attacker package. For unscoped Cluster H - the `paraglide-js@1.0.1` drop is a takeover-style attempt on a namespace close to the legit paraglide-js library; verify the resolved integrity hash matches the real project's current registry entry
8. Verify none of the 91 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-9q28-pqxf-8mgj - @peptide-packets/peptide-modify malware advisory](https://github.com/advisories/GHSA-9q28-pqxf-8mgj) - GitHub
- [GHSA-c4rp-69c2-g2m3 - @peptide-packets/js-unimode malware advisory](https://github.com/advisories/GHSA-c4rp-69c2-g2m3) - GitHub
- [GHSA-9gmr-4p5m-j5vr - socketi malware advisory](https://github.com/advisories/GHSA-9gmr-4p5m-j5vr) - GitHub
- [GHSA-6j64-8q3f-7w69 - soccketio malware advisory](https://github.com/advisories/GHSA-6j64-8q3f-7w69) - GitHub
- [GHSA-q2q2-2vj8-r6q4 - socktio malware advisory](https://github.com/advisories/GHSA-q2q2-2vj8-r6q4) - GitHub
- [GHSA-xgm9-mpc5-qf5w - scketio malware advisory](https://github.com/advisories/GHSA-xgm9-mpc5-qf5w) - GitHub
- [GHSA-6ww9-9hr9-f9m9 - mongostose malware advisory](https://github.com/advisories/GHSA-6ww9-9hr9-f9m9) - GitHub
- [GHSA-3675-4v4m-cxv9 - moontose malware advisory](https://github.com/advisories/GHSA-3675-4v4m-cxv9) - GitHub
- [GHSA-whq9-wwww-4g3q - passsport1 malware advisory](https://github.com/advisories/GHSA-whq9-wwww-4g3q) - GitHub
- [GHSA-j9c9-vv76-9f83 - passtpor malware advisory](https://github.com/advisories/GHSA-j9c9-vv76-9f83) - GitHub
- [GHSA-v4xp-v255-r8cp - ethe.json malware advisory](https://github.com/advisories/GHSA-v4xp-v255-r8cp) - GitHub
- [GHSA-q64r-f9q5-x6m3 - ethers.json malware advisory](https://github.com/advisories/GHSA-q64r-f9q5-x6m3) - GitHub
- [GHSA-h2m8-726m-9cxp - ethersss malware advisory](https://github.com/advisories/GHSA-h2m8-726m-9cxp) - GitHub
- [GHSA-79vf-868m-fv3g - rlp.git malware advisory](https://github.com/advisories/GHSA-79vf-868m-fv3g) - GitHub
- [GHSA-pcfm-f78r-p9wq - rlp-master malware advisory](https://github.com/advisories/GHSA-pcfm-f78r-p9wq) - GitHub
- [GHSA-224j-655w-2vrq - fsextrra malware advisory](https://github.com/advisories/GHSA-224j-655w-2vrq) - GitHub
- [GHSA-cg95-x585-4q9p - fs-extra-master malware advisory](https://github.com/advisories/GHSA-cg95-x585-4q9p) - GitHub
- [GHSA-9qpq-q9v6-pw27 - node-fs-extra-master malware advisory](https://github.com/advisories/GHSA-9qpq-q9v6-pw27) - GitHub
- [GHSA-4f46-w499-cvxr - nano-perf malware advisory](https://github.com/advisories/GHSA-4f46-w499-cvxr) - GitHub
- [GHSA-9c7w-936w-35px - redis-type-xyz malware advisory](https://github.com/advisories/GHSA-9c7w-936w-35px) - GitHub
- [GHSA-xqj6-r3qp-9rx9 - @dexwilt/node-fetch malware advisory](https://github.com/advisories/GHSA-xqj6-r3qp-9rx9) - GitHub
- [GHSA-77gf-97j3-jv6p - @sudoughnym/enviro-demo malware advisory](https://github.com/advisories/GHSA-77gf-97j3-jv6p) - GitHub
- [GHSA-84xr-327r-c8vf - vcse malware advisory](https://github.com/advisories/GHSA-84xr-327r-c8vf) - GitHub
- [GHSA-7j38-gr5c-v4mv - asdsafsadad malware advisory](https://github.com/advisories/GHSA-7j38-gr5c-v4mv) - GitHub
- [GHSA-ffx4-p8v3-667v - asdsafsafdasdsaasdasda malware advisory](https://github.com/advisories/GHSA-ffx4-p8v3-667v) - GitHub
- [GHSA-5xcj-w4qg-g78g - refbase-mcp malware advisory](https://github.com/advisories/GHSA-5xcj-w4qg-g78g) - GitHub
- [GHSA-fmvj-j52v-97x4 - hit-mcp malware advisory](https://github.com/advisories/GHSA-fmvj-j52v-97x4) - GitHub
- [GHSA-694g-9jgf-5566 - mcp-server-boilerplate malware advisory](https://github.com/advisories/GHSA-694g-9jgf-5566) - GitHub
- [GHSA-8cvf-hpjg-mf2j - iwomm-mcp malware advisory](https://github.com/advisories/GHSA-8cvf-hpjg-mf2j) - GitHub
- [GHSA-8whv-6hc5-4wpr - chaos-mcp malware advisory](https://github.com/advisories/GHSA-8whv-6hc5-4wpr) - GitHub
- [GHSA-4ch5-wcxv-58j5 - gtm-mcp-auth malware advisory](https://github.com/advisories/GHSA-4ch5-wcxv-58j5) - GitHub
- [GHSA-fvh4-59gv-h4qp - sap-mcp-facilitator malware advisory](https://github.com/advisories/GHSA-fvh4-59gv-h4qp) - GitHub
- [GHSA-4j2q-gh4v-v729 - sap-mcp-config malware advisory](https://github.com/advisories/GHSA-4j2q-gh4v-v729) - GitHub
- [GHSA-mr5v-ffrr-c4h3 - maximumsats-mcp malware advisory](https://github.com/advisories/GHSA-mr5v-ffrr-c4h3) - GitHub
- [GHSA-993p-762h-628r - kip-mcp-http malware advisory](https://github.com/advisories/GHSA-993p-762h-628r) - GitHub
- [GHSA-87v2-285p-xhrr - pm-claude-skills-mcp malware advisory](https://github.com/advisories/GHSA-87v2-285p-xhrr) - GitHub
- [GHSA-972c-x84x-rm4f - smart-npv-mcp malware advisory](https://github.com/advisories/GHSA-972c-x84x-rm4f) - GitHub
- [GHSA-rxc6-q384-2wrx - routerbase-mcp malware advisory](https://github.com/advisories/GHSA-rxc6-q384-2wrx) - GitHub
- [GHSA-r4wg-xfm2-45qv - @0xlr/dep-confusion-poc malware advisory (smoking-gun name)](https://github.com/advisories/GHSA-r4wg-xfm2-45qv) - GitHub
- [GHSA-pq34-wqrw-jw86 - @0xlr/sentry-web malware advisory](https://github.com/advisories/GHSA-pq34-wqrw-jw86) - GitHub
- [GHSA-mrxf-wq2g-xvxm - @0xlr/prisma-client-js malware advisory](https://github.com/advisories/GHSA-mrxf-wq2g-xvxm) - GitHub
- [GHSA-p9mc-hf7g-gjfx - @0xlr/vercel-analytics malware advisory](https://github.com/advisories/GHSA-p9mc-hf7g-gjfx) - GitHub
- [GHSA-3fr8-m4cc-93fj - @0xlr/stripe-checkout-js malware advisory](https://github.com/advisories/GHSA-3fr8-m4cc-93fj) - GitHub
- [GHSA-c3gr-xj4c-rc53 - @0xlr/stripe-frontend malware advisory](https://github.com/advisories/GHSA-c3gr-xj4c-rc53) - GitHub
- [GHSA-57r8-xw4c-5j59 - @0xlr/clerk-auth malware advisory](https://github.com/advisories/GHSA-57r8-xw4c-5j59) - GitHub
- [GHSA-236w-q9vm-8r42 - @0xlr/supabase-db malware advisory](https://github.com/advisories/GHSA-236w-q9vm-8r42) - GitHub
- [GHSA-p6vh-r7p3-72r9 - @0xlr/test-callback malware advisory](https://github.com/advisories/GHSA-p6vh-r7p3-72r9) - GitHub
- [GHSA-3x4g-gcc2-3jrc - @0xlr/question-types malware advisory](https://github.com/advisories/GHSA-3x4g-gcc2-3jrc) - GitHub
- [GHSA-3357-xmhq-8r86 - @404c3s4r/lodash malware advisory](https://github.com/advisories/GHSA-3357-xmhq-8r86) - GitHub
- [GHSA-m955-rhgf-m5fx - @spending-behavior-ui/widget-insights malware advisory](https://github.com/advisories/GHSA-m955-rhgf-m5fx) - GitHub
- [GHSA-mqcg-v4cw-rgr3 - @spending-behavior-ui/cashflow-widget malware advisory](https://github.com/advisories/GHSA-mqcg-v4cw-rgr3) - GitHub
- [GHSA-cwvh-hhv3-v52q - @finance-ui/finance-view malware advisory](https://github.com/advisories/GHSA-cwvh-hhv3-v52q) - GitHub
- [GHSA-rcgh-7xjx-4rh6 - @finance-ui/snackbar-ifpe malware advisory](https://github.com/advisories/GHSA-rcgh-7xjx-4rh6) - GitHub
- [GHSA-95g5-jx8f-9835 - @nordic-dev/linting-tools malware advisory](https://github.com/advisories/GHSA-95g5-jx8f-9835) - GitHub
- [GHSA-qmwr-pvcq-hhrm - @fuji-web-components/maps malware advisory](https://github.com/advisories/GHSA-qmwr-pvcq-hhrm) - GitHub
- [GHSA-2rh8-4vrh-7vh3 - @meli-testing/jest-react malware advisory](https://github.com/advisories/GHSA-2rh8-4vrh-7vh3) - GitHub
- [GHSA-8w99-rvcw-j7cf - @sw-commons-components/message-upsell malware advisory](https://github.com/advisories/GHSA-8w99-rvcw-j7cf) - GitHub
- [GHSA-w8v3-x4pv-78rp - @mplay-core-lib/utilities malware advisory](https://github.com/advisories/GHSA-w8v3-x4pv-78rp) - GitHub
- [GHSA-xxrf-9xmw-rq5r - @mplay-frontend-ui/link malware advisory](https://github.com/advisories/GHSA-xxrf-9xmw-rq5r) - GitHub
- [GHSA-whq3-7x3r-pv39 - @global-theme/context malware advisory](https://github.com/advisories/GHSA-whq3-7x3r-pv39) - GitHub
- [GHSA-598h-mgjc-c42f - @one-chat/react malware advisory](https://github.com/advisories/GHSA-598h-mgjc-c42f) - GitHub
- [GHSA-chhc-9q4w-p5vq - @sof-assistant-fe-lib/vertical-faqs malware advisory](https://github.com/advisories/GHSA-chhc-9q4w-p5vq) - GitHub
- [GHSA-rcc9-cq4p-xv77 - @mp-op-ss-front-lib/tracks malware advisory](https://github.com/advisories/GHSA-rcc9-cq4p-xv77) - GitHub
- [GHSA-8g97-c5r5-8hjr - @cr-invested-ui-components/chart malware advisory](https://github.com/advisories/GHSA-8g97-c5r5-8hjr) - GitHub
- [GHSA-433p-gj42-fh44 - paraglide-js malware advisory](https://github.com/advisories/GHSA-433p-gj42-fh44) - GitHub
- [GHSA-947j-5gjp-7968 - create-remotion malware advisory](https://github.com/advisories/GHSA-947j-5gjp-7968) - GitHub
- [GHSA-8v58-g8f8-2gpp - capacitor-assets malware advisory](https://github.com/advisories/GHSA-8v58-g8f8-2gpp) - GitHub
- [GHSA-c65v-4v4c-jcpr - fast-csv-helper malware advisory](https://github.com/advisories/GHSA-c65v-4v4c-jcpr) - GitHub
- [GHSA-3w4v-4hp3-9934 - vite-tsconfig-svg malware advisory](https://github.com/advisories/GHSA-3w4v-4hp3-9934) - GitHub
- [GHSA-46cj-57m5-r4wc - react-hot-svg malware advisory](https://github.com/advisories/GHSA-46cj-57m5-r4wc) - GitHub
- [GHSA-qhvp-2j38-vcxv - vite-config-svg malware advisory](https://github.com/advisories/GHSA-qhvp-2j38-vcxv) - GitHub
- [GHSA-h574-ghq2-gh4p - polyprompt malware advisory](https://github.com/advisories/GHSA-h574-ghq2-gh4p) - GitHub
- [GHSA-7gxf-x4v3-6vq7 - goldenflow-js malware advisory](https://github.com/advisories/GHSA-7gxf-x4v3-6vq7) - GitHub
- [GHSA-4wvg-prm7-99h4 - install-native-host malware advisory](https://github.com/advisories/GHSA-4wvg-prm7-99h4) - GitHub
- [GHSA-34m8-mhm4-w3q4 - ai-backup-script malware advisory](https://github.com/advisories/GHSA-34m8-mhm4-w3q4) - GitHub
- [GHSA-69pc-2883-mff3 - iac-scanner malware advisory](https://github.com/advisories/GHSA-69pc-2883-mff3) - GitHub
- [GHSA-5hj6-99cc-g84q - eth-bridge malware advisory](https://github.com/advisories/GHSA-5hj6-99cc-g84q) - GitHub
- [GHSA-9x8c-c54x-vgrv - kelly-stake malware advisory](https://github.com/advisories/GHSA-9x8c-c54x-vgrv) - GitHub
- [GHSA-hf3r-x49q-fxm2 - frontend-regulations malware advisory](https://github.com/advisories/GHSA-hf3r-x49q-fxm2) - GitHub
- [GHSA-g4m5-r29v-w7gh - metrics-ui malware advisory](https://github.com/advisories/GHSA-g4m5-r29v-w7gh) - GitHub
- [GHSA-x9p4-637q-6wjw - sso-users-detection malware advisory](https://github.com/advisories/GHSA-x9p4-637q-6wjw) - GitHub
- [GHSA-hh3x-6gh6-rhxf - notifications-broadcast malware advisory](https://github.com/advisories/GHSA-hh3x-6gh6-rhxf) - GitHub
- [GHSA-j5q6-x29x-2v5x - portway malware advisory](https://github.com/advisories/GHSA-j5q6-x29x-2v5x) - GitHub
- [GHSA-gpj6-4r9m-prh8 - allurectl malware advisory](https://github.com/advisories/GHSA-gpj6-4r9m-prh8) - GitHub
- [GHSA-jhrx-465c-725f - adpanel-core malware advisory](https://github.com/advisories/GHSA-jhrx-465c-725f) - GitHub
- [GHSA-g8cx-prcq-676p - hazmat-cfr malware advisory](https://github.com/advisories/GHSA-g8cx-prcq-676p) - GitHub
- [GHSA-h74v-846x-863c - attio-discover malware advisory](https://github.com/advisories/GHSA-h74v-846x-863c) - GitHub
- [GHSA-cr3h-6mq7-f6q9 - community-published malware advisory](https://github.com/advisories/GHSA-cr3h-6mq7-f6q9) - GitHub
- [GHSA-rvcg-4hj7-jmv2 - process-status-widget malware advisory](https://github.com/advisories/GHSA-rvcg-4hj7-jmv2) - GitHub
- [GHSA-4x59-mhxh-4ghc - polylabel-web-lib malware advisory](https://github.com/advisories/GHSA-4x59-mhxh-4ghc) - GitHub
- [GHSA-7p2c-jxw4-jxvv - rollup-plugin-polyfill-hold malware advisory](https://github.com/advisories/GHSA-7p2c-jxw4-jxvv) - GitHub
- [GHSA-583c-qcpm-pcw6 - rollup-plugin-polyfill-helper malware advisory](https://github.com/advisories/GHSA-583c-qcpm-pcw6) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-07-31-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-07-31-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).