# GitHub Advisory npm CWE-506 sweep - 8-package 2026-08-02 batch (`houzidawang806/807/808` sequential-namespace trio, `simple-date-formatter-util`/`-1`/`-2` date-util trio, `tailwindcss-anim` Tailwind-ecosystem typosquat, `list-issue-predecessor-dependencies-block@99.0.0` OpenSSF-PA C2-domain communicator with dep-confusion inflated pin)

> GHSA published 8 npm CWE-506 advisories dated 2026-08-02 - a `houzidawang806/807/808` sequential-namespace trio, a `simple-date-formatter-util` + `-1` + `-2` date-utility trio, `tailwindcss-anim` under the Tailwind CSS ecosystem name shape, and `list-issue-predecessor-dependencies-block@99.0.0` flagged by OpenSSF Package Analysis for both malicious-domain communication AND malicious-command execution with the extreme-inflated dep-confusion pin (`99.0.0`).

- Published: 2026-08-02
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 8 packages, 8 compromised versions
- Tags: dependency-confusion, typosquat, ci-cd-compromise, credential-theft, infostealer
- Also known as: 2026-08-02 GHSA npm batch, houzidawang* burst, simple-date-formatter-util trio, tailwindcss-anim typosquat, list-issue-predecessor-dependencies-block C2 communicator
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-08-02-ghsa-malware-sweep

## Affected packages (8)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [houzidawang806](https://dependencywatch.io/package/npm/houzidawang806) | npm | 1.0.0 |
| [houzidawang807](https://dependencywatch.io/package/npm/houzidawang807) | npm | 1.0.0 |
| [houzidawang808](https://dependencywatch.io/package/npm/houzidawang808) | npm | 1.0.0 |
| [list-issue-predecessor-dependencies-block](https://dependencywatch.io/package/npm/list-issue-predecessor-dependencies-block) | npm | 99.0.0 |
| [simple-date-formatter-util](https://dependencywatch.io/package/npm/simple-date-formatter-util) | npm | 1.0.0 |
| [simple-date-formatter-util-1](https://dependencywatch.io/package/npm/simple-date-formatter-util-1) | npm | 1.0.0 |
| [simple-date-formatter-util-2](https://dependencywatch.io/package/npm/simple-date-formatter-util-2) | npm | 1.0.0 |
| [tailwindcss-anim](https://dependencywatch.io/package/npm/tailwindcss-anim) | npm | 1.0.0 |

## What happened

On 2026-08-02, the GitHub Advisory Database published **8 new npm CWE-506 (Embedded Malicious Code) advisories** in a same-day burst. This module catalogues that batch. Modest-sized batch relative to the massive 2026-07-31 wave (91 packages) - the 08-02 batch reads as tail-end operator activity with two coordinated 3-package name-template bursts plus one Tailwind-ecosystem typosquat and one OpenSSF-PA-flagged C2-domain communicator with dep-confusion pinning.

## Cluster A - `houzidawang806/807/808` sequential-namespace trio (3 packages, 2026-08-02)

| Package | Notes |
|---|---|
| `houzidawang806` | `houzidawang<NNN>` numbered-namespace template |
| `houzidawang807` | `houzidawang<NNN>` numbered-namespace template |
| `houzidawang808` | `houzidawang<NNN>` numbered-namespace template |

Same-day publish of 3 packages under a shared `houzidawang<NNN>` naming template. Every advisory in the cluster carries the standard CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised") with no additional per-package behaviour prose. The `houzi dawang` root reads as a CJK transliteration ("monkey king", 猴子大王, or a similar handle) and the numeric suffix increments sequentially (`806`, `807`, `808`) - consistent with an operator running a namespace-enumeration burst using a fixed handle plus a counter.

The naming pattern reads strongly as **researcher / red-team upload activity** - no ordinary developer types `npm install houzidawang807` - but GHSA classified all 3 as CWE-506 embedded malicious code, meaning static analysis or Package Analysis (OpenSSF) tripped on real malicious behaviour in the tarballs regardless of the researcher-vs-criminal origin. A lockfile hit is still an incident: either genuine malware or an unauthorised researcher upload that still exfiltrates on install.

## Cluster B - `simple-date-formatter-util` + `-1` + `-2` date-utility trio (3 packages, 2026-08-02)

| Package | Notes |
|---|---|
| `simple-date-formatter-util` | canonical `simple-*-formatter-util` typosquat lane |
| `simple-date-formatter-util-1` | numbered variant (`-1` sibling) |
| `simple-date-formatter-util-2` | numbered variant (`-2` sibling) |

Same-day publish of 3 packages under a shared `simple-date-formatter-util[-N]` naming template. All three share the CWE-506 boilerplate ("fully compromised, rotate secrets"). The `-1`/`-2` sibling variants are a common operator pattern for **hedging against a takedown**: if npm security removes `simple-date-formatter-util`, the `-1` and `-2` copies remain resolvable until the takedown enumerates the numbered siblings. Same pattern observed in the earlier `test-dev-*` bursts and the `date-sanitize-helper` / `string-format-kit` clusters.

The `simple-date-formatter-util` name plausibly typosquats one of the ~40 legitimate `simple-*-formatter` / `date-format-*` / `date-fns-*` utility packages that ship a `SimpleDateFormatter` API surface (a well-known Java API name that many JS ports mirror). Developers searching for a "simple date formatter util" via `npm search` or dev-tooling autocomplete would plausibly land on one of these names.

## Cluster C - `tailwindcss-anim` Tailwind-ecosystem typosquat (1 package, 2026-08-02)

| Package | Notes |
|---|---|
| `tailwindcss-anim` | typosquat against `tailwindcss-animate` (~1.7M weekly downloads) |

GHSA-m326-xg22-g2fx carries the standard CWE-506 boilerplate. The `tailwindcss-anim` name shape is a **classic abbreviated-suffix typosquat** against the highly-popular legitimate `tailwindcss-animate` plugin - the `-anim` suffix reads as the natural developer-shorthand for `animate` / `animation` and would resolve preferentially for anyone typing from memory rather than copy-pasting from Tailwind's official docs.

The operator followed up with a same-lane counterpart `tailwind-anim` (dropping the `css` connector) published one day later on 2026-08-03 - see `npm-2026-08-03-ghsa-malware-sweep` Cluster A. The two variants together cover the two most common autocomplete-truncation misspellings of `tailwindcss-animate`.

## Cluster D - `list-issue-predecessor-dependencies-block@99.0.0` OpenSSF-PA C2-domain communicator with dep-confusion pin (1 package, 2026-08-02)

| Package | Version | Notes |
|---|---|---|
| `list-issue-predecessor-dependencies-block` | `99.0.0` | OpenSSF PA: malicious-domain communication + malicious-command execution, dep-confusion inflated pin |

GHSA-fjgr-3cq9-qxm6 records OpenSSF Package Analysis flagged the tarball for **both** "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior." Two distinct dynamic-analysis signals - active outbound C2 traffic AND command execution observed at analysis time - indicating this is not a static-metadata heuristic flag but confirmed runtime malicious behaviour.

The `99.0.0` version pin is the **canonical dependency-confusion inflated pin** - it guarantees the resolver picks the public malicious version over any internal `list-issue-predecessor-dependencies-block` library at any real semver like `1.2.3` or `4.5.6`. The verbose highly-specific package name (`list-issue-predecessor-dependencies-block`) reads as an **internal-tooling naming shape** - plausibly a Jira / GitHub Issue integration tool that lists issues blocking or being blocked by a target issue via a predecessor-dependencies query (Jira Portfolio, Structure, BigPicture, and similar issue-dependency-graph tools all expose this concept). An org that maintains such tooling as an internal npm package would resolve the public malicious version preferentially on any CI job that misconfigures its `.npmrc` scope or `--registry` precedence.

## Registry state

All 8 packages security-replaced during the 2026-08-02 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Cluster A `houzidawang*` sequential-namespace burst matches the pattern of the `test-dev-*` 8-package burst catalogued in `npm-2026-08-01-ghsa-malware-sweep` Cluster A. Same operator profile (test-shape names published in bursts, GHSA-flagged CWE-506, no per-package behaviour prose).
- Cluster B `simple-date-formatter-util[-N]` numbered-variant lane matches the same take-down-hedging pattern used in earlier `date-sanitize-helper` / `string-format-kit` clusters catalogued across the 2026-07-2x sweeps.
- Cluster C `tailwindcss-anim` explicitly pairs with the 2026-08-03 `tailwind-anim` variant (see `npm-2026-08-03-ghsa-malware-sweep` Cluster A) - same operator, adjacent-day publishes on the two most likely autocomplete-truncation misspellings of `tailwindcss-animate`.
- Cluster D `list-issue-predecessor-dependencies-block@99.0.0` is the same C2-domain + command-execution OpenSSF-PA signature seen in `pp-react-worldready@1.0.0` (2026-08-01), `num-format-helper` / `string-format-kit` / `date-sanitize-helper` (2026-07-29), and the earlier `phabricator-client@99.x` PyPI advisories - recurring OpenSSF-PA-flagged single-package drops with dep-confusion inflated version pins.
- No `threatActor` field is set - GHSA advisories in this batch use only the CWE-506 boilerplate with no named actor attribution.

## Impact

- Any host that installed any of the 8 npm packages listed below should be treated as fully compromised - every GHSA advisory in this batch uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
- **Cluster A - `houzidawang806/807/808` sequential-namespace trio** (3 packages, all `>= 0`, all 2026-08-02): `houzidawang806`, `houzidawang807`, `houzidawang808`. Same-day publish of 3 packages under a shared `houzidawang<NNN>` numbered-namespace template - one operator running a namespace-enumeration burst using a fixed CJK-transliterated username (`houzi dawang` roughly transliterates from Mandarin as "monkey king") plus a numeric suffix. The naming pattern reads as researcher / red-team test uploads (no developer would `npm install houzidawang806`), but GHSA classifies all 3 as CWE-506 embedded malicious code so treat lockfile hits as real incidents
- **Cluster B - `simple-date-formatter-util` + `-1` + `-2` date-utility trio** (3 packages, all `>= 0`, all 2026-08-02): `simple-date-formatter-util`, `simple-date-formatter-util-1`, `simple-date-formatter-util-2`. Same-day publish of 3 packages under a shared `simple-date-formatter-util[-N]` naming template - plausibly a typosquat probe against the ~40 legitimate `simple-*-formatter` / `date-format-*` utility packages that ship a `SimpleDateFormatter` API surface for React and Node dev tooling. Consumers running dev-tools autocomplete or `npm search` for a "simple date formatter util" would plausibly land on one of these names
- **Cluster C - `tailwindcss-anim` Tailwind-ecosystem typosquat** (1 package, `>= 0`, 2026-08-02): `tailwindcss-anim`. Name-shape typosquat against the legitimate `tailwindcss-animate` (~1.7M weekly downloads) and `tailwindcss-animated` - the abbreviated `-anim` suffix relies on autocomplete truncation or memory-slip from developers who remember the animation package as "the Tailwind anim plugin". Same-operator counterpart to the `tailwind-anim` variant published one day later under the 2026-08-03 batch (see `npm-2026-08-03-ghsa-malware-sweep`)
- **Cluster D - `list-issue-predecessor-dependencies-block@99.0.0` OpenSSF-PA C2-domain communicator with dep-confusion inflated pin** (1 package, `= 99.0.0`, 2026-08-02): `list-issue-predecessor-dependencies-block`. GHSA-fjgr-3cq9-qxm6 records OpenSSF PA flagged the tarball for BOTH "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior" - active outbound C2 traffic plus command execution observed at analysis time (not merely static-metadata heuristics). The extreme-inflated `99.0.0` version pin is the canonical dep-confusion technique targeting an internal `list-issue-predecessor-dependencies-block` package plausibly used inside a Jira / GitHub Issue integration tool at an org that maintains issue-dependency-graph tooling as an internal npm package
- None of the 8 packages retain original tarballs on the public npm registry - all replaced with security sentinels during takedown. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **Cluster A (`houzidawang*`)**: any lockfile hit on any of the 3 `houzidawang<NNN>` packages is either a researcher/red-team unauthorised upload landing on your CI or an actual malicious drop - both require the same response. Delete the resolved package, purge from any private-registry cache, and rotate the credentials that the build had access to. If pulled by a downstream transitive dependency, escalate to a broader dep-graph audit - that transitive path is the real vulnerability
3. **Cluster B (`simple-date-formatter-util*`)**: any lockfile hit is a supply-chain incident - the operator is riding the `simple-*-formatter-util` typosquat lane against the ~40 legitimate `simple-date-*`/`date-format-*` utility packages. Confirm the intended package name against the actual dependency the developer meant to add, delete the malicious resolution, and rotate every credential the build runner could reach
4. **Cluster C (`tailwindcss-anim`)**: any lockfile hit is a Tailwind-ecosystem typosquat incident - the operator is targeting the ~1.7M-weekly-download `tailwindcss-animate` legitimate package. Confirm the intended package (typically `tailwindcss-animate` or `tailwindcss-animated`), delete the malicious `tailwindcss-anim` resolution, and rotate every credential the build could reach. The counterpart `tailwind-anim` variant (see `npm-2026-08-03-ghsa-malware-sweep`) uses the same typosquat lane and warrants the same response
5. **Cluster D (`list-issue-predecessor-dependencies-block@99.0.0`)**: any lockfile hit is a supply-chain incident - OpenSSF PA specifically flagged live outbound traffic to a known-malicious domain AND malicious command execution, indicating the payload phones out AND executes commands during install or import. Orgs that maintain a `list-issue-predecessor-dependencies-block` internal npm package (Jira / GitHub Issue integration tooling): configure `.npmrc` scope-to-registry mapping or `overrides` to block the public-registry version from resolving, and audit outbound DNS from any host that resolved this package in the last 72h
6. For every npm install in CI, run with `--ignore-scripts` as defense-in-depth to prevent postinstall-triggered payloads from executing during dependency installation
7. Verify none of the 8 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-7gf8-h22p-4qr4 - houzidawang806 malware advisory](https://github.com/advisories/GHSA-7gf8-h22p-4qr4) - GitHub
- [GHSA-f2g2-48mf-957v - houzidawang807 malware advisory](https://github.com/advisories/GHSA-f2g2-48mf-957v) - GitHub
- [GHSA-4qvg-392x-j32q - houzidawang808 malware advisory](https://github.com/advisories/GHSA-4qvg-392x-j32q) - GitHub
- [GHSA-q32h-xc3m-rc77 - simple-date-formatter-util malware advisory](https://github.com/advisories/GHSA-q32h-xc3m-rc77) - GitHub
- [GHSA-mmc7-8pmj-h3xj - simple-date-formatter-util-1 malware advisory](https://github.com/advisories/GHSA-mmc7-8pmj-h3xj) - GitHub
- [GHSA-q43f-5xj6-8v63 - simple-date-formatter-util-2 malware advisory](https://github.com/advisories/GHSA-q43f-5xj6-8v63) - GitHub
- [GHSA-m326-xg22-g2fx - tailwindcss-anim malware advisory (Tailwind CSS ecosystem typosquat)](https://github.com/advisories/GHSA-m326-xg22-g2fx) - GitHub
- [GHSA-fjgr-3cq9-qxm6 - list-issue-predecessor-dependencies-block malware advisory (OpenSSF PA C2 + command exec, dep-confusion inflated pin)](https://github.com/advisories/GHSA-fjgr-3cq9-qxm6) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-02-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-02-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).