DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 3 Aug 2026Updated 4 Aug 202617 packages · 20 versions

GitHub Advisory npm CWE-506 sweep - 18-package 2026-08-03 batch (`@types-beta/sdk@0.1.0-0.1.3` `@types`-namespace impersonation with Windows `nanocache.exe` WinHTTP-WebSocket RAT, 5-package `beaver-ui-*` component-library burst, `internallib_v524`/`v568` sequential dep-confusion continuation, `simple-date-formatter-new-1`/`-util-5` OpenSSF-PA C2 + command-execution pair, `tailwind-anim` Tailwind-ecosystem typosquat second-day companion, `@custombots/custombot@1.0.0` OpenSSF-PA malicious-command scoped RAT, and 5-package internal-tooling dep-confusion singleton burst)

Summary

GHSA published 18 npm CWE-506 advisories dated 2026-08-03. Most severe: @types-beta/sdk@0.1.0-0.1.3 - a @types-namespace impersonation embedding a Windows nanocache.exe WinHTTP WebSocket RAT. Batch also includes a 5-package beaver-ui-* dep-confusion burst, internallib_v524/v568 continuation, simple-date-formatter-* OpenSSF-PA C2+cmd pair, tailwind-anim, and 5 more.

typosquatdependency-confusionci-cd-compromisecredential-theftinfostealeraccount-takeover
Detected by
GitHub Advisory Database · OpenSSF Package Analysis · npm Security · codelake Research
Also known as
2026-08-03 GHSA npm batch · tailwind-anim typosquat · @custombots scoped RAT · @types-beta/sdk nanocache.exe RAT · beaver-ui component-library dep-confusion burst · internallib_v<NNN> sequential enumeration · simple-date-formatter continuation
Ecosystems
npm
Packages tracked
17

What happened

On 2026-08-03, the GitHub Advisory Database published 18 new npm CWE-506 (Embedded Malicious Code) advisories in a same-day burst. This module catalogues that batch. Larger than the 8-package 2026-08-02 batch and dominated by a Windows RAT payload (@types-beta/sdk), a 5-package component-library dep-confusion burst (beaver-ui-*), and continuation of the simple-date-formatter-* and internallib_* operator lanes seen the previous day.

Cluster A - tailwind-anim Tailwind-ecosystem typosquat (1 package, 2026-08-03)

| Package | Notes | |---|---| | tailwind-anim | typosquat against tailwindcss-animate (~1.7M weekly downloads), same-operator second-day companion to tailwindcss-anim |

GHSA-7xhc-fvmj-h5xj carries the standard CWE-506 boilerplate. The tailwind-anim name shape is the shortest natural autocomplete-truncation misspelling of the highly-popular legitimate tailwindcss-animate plugin - drops both the css connector and the -ate suffix.

This is a same-operator second-day companion to the 2026-08-02 tailwindcss-anim variant (see npm-2026-08-02-ghsa-malware-sweep Cluster C). Two variants published on adjacent days covering the two most common autocomplete-truncation misspellings of tailwindcss-animate.

Cluster B - @custombots/custombot@1.0.0 OpenSSF-PA scoped RAT (1 package, 2026-08-03)

| Package | Version | Notes | |---|---|---| | @custombots/custombot | 1.0.0 | OpenSSF PA: "executes one or more commands associated with malicious behavior" - scoped RAT under attacker-controlled @custombots scope |

GHSA-77jv-xw6r-q246 records OpenSSF Package Analysis flagged the tarball because it "executes one or more commands associated with malicious behavior" - active command execution observed at analysis time, not merely static-metadata heuristics.

Attacker-controlled @custombots scope with a custombot sub-name. Multiple small SaaS platforms operate under the "CustomBots" brand (Discord bot builders, WhatsApp chatbot platforms, no-code automation) - the malicious scope is plausibly a *targeted publish against organisations that maintain internal `@custombots/` chatbot / bot-builder / automation tooling** as private npm packages.

Cluster C - @types-beta/sdk@0.1.0-0.1.3 @types-namespace impersonation with Windows nanocache.exe WinHTTP RAT (1 package, 4 versions, 2026-08-03)

| Package | Versions | Notes | |---|---|---| | @types-beta/sdk | 0.1.0, 0.1.1, 0.1.2, 0.1.3 | @types-namespace impersonation; embedded Windows vendor/nanocache.exe; WinHTTP WebSocket RAT; import-time side effect |

Most severe payload in the 2026-08-03 batch. GHSA-j9jc-8h3g-qqrx records that @types-beta/sdk is a supply-chain dropper masquerading as a legitimate type-definition library from the trusted-looking @types-beta scope.

Full behaviour chain per the advisory:

  1. Embedded Windows PE: bundles vendor/nanocache.exe inside the tarball.
  2. Import-time execution: spawns the binary via Node's child_process as an import-time side effect on Windows - NOT a postinstall hook. Running npm install --ignore-scripts does NOT stop it. Any require("@types-beta/sdk") or ESM import triggers spawn.
  3. WinHTTP WebSocket RAT: the binary implements a WinHTTP WebSocket agent that "dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel".
  4. Interactive command execution: the RAT executes remote commands and initiates interactive PowerShell sessions ([>] cmd: %s).
  5. Resilience: automatic reconnection.

Detection credited to codelake Research monitoring the live npm feed.

The 4 sequential versions 0.1.0, 0.1.1, 0.1.2, 0.1.3 indicate the operator iterated on the payload during the drop window - likely refining evasion or payload behaviour before takedown. All 4 versions carry the same malicious tarball shape.

The @types-beta scope is NOT an official DefinitelyTyped sub-scope - the legitimate npm namespace for community TypeScript type definitions is exactly @types/* (not @types-something/*). @types-beta is a deliberate visual near-collision designed to catch a developer who half-remembers a "beta types SDK" and grabs the first result. Consumers should audit .npmrc for any misconfigured trust of @types-beta and treat any inclusion as an intrusion.

Cluster D - 5-package beaver-ui-* component-library dep-confusion burst (5 packages, 2026-08-03)

| Package | Notes | |---|---| | beaver-ui-items-with-more | component library - "items with more" overflow chip | | beaver-ui-header | component library - header | | beaver-ui-date-range-picker | component library - date range picker | | beaver-ui-layout | component library - layout primitive | | beaver-ui-grid | component library - grid primitive |

Same-day coordinated publish of 5 packages under a shared beaver-ui-<component> naming template. All 5 GHSA advisories carry the standard CWE-506 boilerplate with no per-package behaviour prose.

The 5-name shape covers the standard component-library taxonomy (grid, layout, header, date-range-picker, items-with-more overflow chip). This is the canonical shape of a dependency-confusion component-library burst: an operator enumerates the highest-probability internal component names of any org that maintains an internal @beaver-ui/* or beaver-ui-* React / Vue / Angular design system. If any target org publishes even one component under this name shape internally, the burst will catch it.

Multiple small companies and product teams brand internal design systems as "Beaver UI" (the animal-name design-system naming convention is popular - Panda CSS, Chakra UI, Ant Design, Radix, etc.). The operator is casting a wide net across real corporate internal namespaces.

Cluster E - internallib_v524/v568 sequential dep-confusion continuation (2 packages, 2026-08-03; paired with v688 on 08-04)

| Package | Notes | |---|---| | internallib_v524 | internallib_v<NNN> sequential dep-confusion probe | | internallib_v568 | internallib_v<NNN> sequential dep-confusion probe |

Both advisories carry standard CWE-506 boilerplate. The internallib_v<NNN> naming template is a *canonical dep-confusion probe against orgs that publish internal `internallib_ packages** to their private registry - the internal` prefix is an explicit tell.

Adjacent-day continuation: the operator dropped internallib_v688 on 2026-08-04 (see npm-2026-08-04-ghsa-malware-sweep), suggesting a numeric-suffix enumeration loop where the operator publishes fresh v<NNN> versions periodically to catch any misconfigured internal registry that resolves the higher public version over the internal one.

The non-sequential jumps (v524, v568, v688) suggest the operator is not enumerating exhaustively but sampling ranges - possibly correlated to real version numbers observed in leaked or scraped internal package manifests.

Cluster F - simple-date-formatter-new-1/-util-5 OpenSSF-PA C2 + command-execution pair (2 packages, 2026-08-03)

| Package | Notes | |---|---| | simple-date-formatter-new-1 | OpenSSF PA: malicious-domain communication + malicious-command execution | | simple-date-formatter-util-5 | OpenSSF PA: malicious-domain communication + malicious-command execution |

Both GHSA-83gm-93p7-wh7r and GHSA-rhm2-fwx3-922c carry specific OpenSSF Package Analysis dynamic-analysis prose:

> "The package communicates with a domain associated with malicious activity." > "The package executes one or more commands associated with malicious behavior."

Two distinct dynamic-analysis signals per package - active outbound C2 traffic AND command execution observed at analysis time. This is a direct continuation of the simple-date-formatter-util + -1 + -2 trio catalogued in the 2026-08-02 batch (see npm-2026-08-02-ghsa-malware-sweep Cluster B).

The operator escalated behaviour: on 2026-08-02 the trio carried only generic CWE-506 boilerplate; on 2026-08-03 the new drops carry confirmed dynamic-analysis C2 + command-execution. Either the payload changed between drops, or OpenSSF PA analysis caught up to the earlier drops in a later scan - either way the whole simple-date-formatter-* operator lane is now confirmed as an active-C2 dropper.

Cluster G - 5-package internal-tooling dep-confusion singleton burst (5 packages, 2026-08-03)

| Package | Notes | |---|---| | accounts-final-form | internal-tooling name shape - react-final-form accounts wrapper | | accounts-loading-state | internal-tooling name shape - accounts UI loading state | | bigops-chat-messages | internal-tooling name shape - BigOps observability / chat integration | | fluid-type-ui | internal-tooling name shape - fluid-typography design-system primitive | | lifestyle-test-utils | internal-tooling name shape - Lifestyle-brand internal test tooling |

Same-day drop of 5 unrelated singletons all shaped as internal-tooling package names. All 5 GHSA advisories carry the standard CWE-506 boilerplate with no per-package behaviour prose.

  • accounts-final-form and accounts-loading-state share an accounts-* prefix consistent with an internal auth / user-management module namespace at a real target org.
  • bigops-chat-messages references the "BigOps" brand (BigOps.io, an observability / SRE tooling vendor) - plausibly targeting an internal chat-integration module.
  • fluid-type-ui matches the "fluid typography" design-system idiom used in Bootstrap 5, Tailwind Fluid Typography, and similar toolkits.
  • lifestyle-test-utils reads as a brand-scoped internal test-utils package (multiple lifestyle-brand companies publish npm packages).

This matches the wider enterprise/vendor-scope brand-impersonation sweep pattern documented across the 2026-07-2x through 2026-08-0x batches (@finance-ui, @spending-behavior-ui, @meli-testing, @cr-invested-ui-components, @moxfive-llc/common, @custombots/custombot, etc.). The operator is enumerating plausibly-unique internal-tooling names hoping any real org has misconfigured .npmrc scope precedence.

Registry state

All 18 packages security-replaced during the 2026-08-03 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

  • Cluster A tailwind-anim is the same-operator second-day companion to tailwindcss-anim catalogued in npm-2026-08-02-ghsa-malware-sweep Cluster C - treat as a single logical typosquat campaign against tailwindcss-animate.
  • Cluster B @custombots/custombot and Cluster G singletons together extend the enterprise-scope brand-impersonation sweep catalogued in npm-2026-07-31-ghsa-malware-sweep Cluster G and the 2026-08-01 @moxfive-llc/common scoped RAT.
  • Cluster C @types-beta/sdk is the highest-severity new payload of the 2026-08-03 batch - a genuine active-C2 Windows RAT under a @types-namespace impersonation is qualitatively distinct from the CWE-506-boilerplate mass drops. Compare to the earlier @types-registry/* and @types-node-* typosquat clusters that historically leverage the @types/* scope trust.
  • Cluster E internallib_v524/v568 pairs with internallib_v688 on 2026-08-04 - same operator, sequential-numeric enumeration campaign against internallib_* internal packages.
  • Cluster F simple-date-formatter-* continuation confirms the simple-date-formatter-util operator lane is an active-C2 dropper, not just researcher noise.
  • Detection for Cluster C is credited to codelake Research - a new research entity showing up in the 2026 npm-malware detection landscape.
  • No threatActor field is set - GHSA advisories in this batch use only CWE-506 boilerplate / OpenSSF-PA autotriage prose / codelake Research detection prose with no named actor attribution.

Affected packages (17)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Any host that installed any of the 18 npm packages listed below should be treated as fully compromised - every GHSA advisory uses the CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer") and no patched version exists. Two clusters carry additional dynamic-analysis prose: Cluster C @types-beta/sdk is a live Windows RAT and Cluster F simple-date-formatter-* has OpenSSF-PA C2 + command-execution flags
  • Cluster A - tailwind-anim Tailwind-ecosystem typosquat second-day companion (1 package, >= 0, 2026-08-03): tailwind-anim. Direct autocomplete-truncation typosquat against the ~1.7M-weekly-download legitimate tailwindcss-animate - the tailwind-anim form drops both the css connector and the -ate suffix. Same-operator counterpart to tailwindcss-anim published one day earlier under the 2026-08-02 batch (see npm-2026-08-02-ghsa-malware-sweep Cluster C)
  • Cluster B - @custombots/custombot@1.0.0 OpenSSF-PA malicious-command-execution scoped RAT (1 package, = 1.0.0, 2026-08-03): @custombots/custombot. GHSA-77jv-xw6r-q246 records OpenSSF Package Analysis flagged the tarball for "executes one or more commands associated with malicious behavior" - active command execution observed at analysis time. Attacker-controlled @custombots scope catches any org that maintains internal @custombots/* chatbot / Discord-bot / automation tooling and misconfigures .npmrc scope precedence
  • Cluster C - @types-beta/sdk@0.1.0-0.1.3 @types-namespace impersonation with Windows nanocache.exe RAT (1 package, 4 versions 0.1.0, 0.1.1, 0.1.2, 0.1.3, 2026-08-03): @types-beta/sdk. GHSA-j9jc-8h3g-qqrx records that the tarball is a supply-chain dropper masquerading as a legitimate type-definition library from the trusted-looking @types-beta scope. Bundles vendor/nanocache.exe (Windows PE) and spawns it via child_process as an import-time side effect (not a postinstall hook - --ignore-scripts does NOT stop it), implements a WinHTTP WebSocket-based RAT that "dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel", executes remote commands, and initiates interactive PowerShell sessions. Detection credited to codelake Research monitoring the live npm feed. The 4 sequential versions 0.1.0 through 0.1.3 indicate the operator iterated on the payload during the drop window before takedown
  • *Cluster D - 5-package `beaver-ui- component-library burst** (5 packages, all >= 0, all 2026-08-03): beaver-ui-items-with-more, beaver-ui-header, beaver-ui-date-range-picker, beaver-ui-layout, beaver-ui-grid. Same-day coordinated publish of 5 packages under a shared beaver-ui-<component> naming template - canonical **dependency-confusion component-library burst** targeting orgs that maintain an internal @beaver-ui/ or beaver-ui- React / Vue / Angular design system (a common internal-tooling brand). All 5 names cover the standard component-library taxonomy (grid, layout, header, date-range-picker, items-with-more) - the operator is enumerating high-probability internal component names to maximise dep-confusion hits across any real internal beaver-ui` design system
  • Cluster E - internallib_v524/v568 sequential dep-confusion continuation (2 packages, both >= 0, both 2026-08-03; paired with internallib_v688 on 2026-08-04): internallib_v524, internallib_v568. The internallib_v<NNN> naming template is the canonical *dep-confusion probe against orgs that publish internal `internallib_ scoped or unscoped packages to their private registry**. Adjacent-day drops with fresh numeric suffixes (v524, v568, v688 on 08-04) indicate an operator running a numeric-suffix enumeration loop against the public registry - every fresh v<NNN>` version is a new attempt to catch an internal-registry misconfiguration
  • Cluster F - simple-date-formatter-new-1/-util-5 OpenSSF-PA C2 + command-execution pair (2 packages, both >= 0, both 2026-08-03): simple-date-formatter-new-1, simple-date-formatter-util-5. Both GHSA-83gm-93p7-wh7r and GHSA-rhm2-fwx3-922c carry specific OpenSSF Package Analysis dynamic-analysis prose: "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior" - active outbound C2 traffic plus command execution observed at analysis time. Direct continuation of the simple-date-formatter-util + -1 + -2 trio catalogued in the 2026-08-02 batch (see npm-2026-08-02-ghsa-malware-sweep Cluster B) - the operator escalated from generic CWE-506 boilerplate on 08-02 to confirmed dynamic-analysis C2 + command-exec behaviour on 08-03
  • Cluster G - 5-package internal-tooling dep-confusion singleton burst (5 packages, all >= 0, all 2026-08-03): accounts-final-form, accounts-loading-state, bigops-chat-messages, fluid-type-ui, lifestyle-test-utils. Same-day drop of 5 unrelated singletons all shaped as internal-tooling package names: accounts-* (auth / user-management), bigops-chat-messages (BigOps observability / chat integration), fluid-type-ui (fluid-typography design-system component), lifestyle-test-utils (Lifestyle brand internal test tooling). All match the pattern of small companies / product teams that publish an internal design-system component or shared library under a plausibly-unique but not-actually-unique name - the operator is running a wide dep-confusion sweep against real corporate internal namespaces in the hope that at least one target org has misconfigured .npmrc scope precedence
  • None of the 18 packages retain original tarballs on the public npm registry - all replaced with security sentinels during takedown. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
  2. 2Cluster C (@types-beta/sdk) - CRITICAL Windows RAT: any lockfile hit at any of 0.1.0, 0.1.1, 0.1.2, 0.1.3 - treat every Windows host that imported this package as fully compromised with an active RAT. The nanocache.exe payload executes as an import-time side effect via child_process, NOT a postinstall hook - running with npm install --ignore-scripts does NOT prevent execution. Any dev workstation, CI runner, or production host that ran require("@types-beta/sdk") or import "@types-beta/sdk" has spawned the RAT. Kill any nanocache.exe process on the host, revoke any WinHTTP outbound connections to unknown domains, rotate every credential the host had access to, re-image, and audit outbound network history from the host for WebSocket connections to unknown domains. The @types-beta scope is NOT an official @types/* sub-scope - the legitimate DefinitelyTyped scope is @types/* - audit .npmrc for any misconfigured trust of @types-beta
  3. 3Cluster A (tailwind-anim): any lockfile hit is a Tailwind-ecosystem typosquat incident targeting tailwindcss-animate (~1.7M weekly downloads). Confirm the intended package (typically tailwindcss-animate or tailwindcss-animated), delete the malicious tailwind-anim resolution, and rotate every credential the build could reach
  4. 4Cluster B (@custombots/custombot@1.0.0): any lockfile hit is a supply-chain incident - OpenSSF PA flagged live command execution. Orgs that maintain internal @custombots/* tooling: configure .npmrc scope-to-registry mapping so @custombots resolves to a trusted internal registry, or add an explicit overrides block in package.json
  5. 5*Cluster D (`beaver-ui- 5-package burst)**: any lockfile hit on any of the 5 beaver-ui- names is a dependency-confusion incident targeting an internal beaver-ui design system. Orgs that maintain a real internal beaver-ui or @beaver-ui/ component library: configure .npmrc scope-to-registry mapping (if scoped) or use overrides` to block the public-registry versions from resolving. Audit outbound network from any build host that resolved any of the 5 in the last 72h
  6. 6Cluster E (internallib_v524/v568): any lockfile hit is a dep-confusion incident targeting orgs that publish internallib_v<NNN> internal packages. The internallib_ prefix is a strong internal-package name shape - configure .npmrc scope precedence or overrides block. The paired internallib_v688 variant on 2026-08-04 (see npm-2026-08-04-ghsa-malware-sweep) uses the same enumeration lane
  7. 7Cluster F (simple-date-formatter-new-1/-util-5): any lockfile hit - OpenSSF PA specifically flagged outbound traffic to a malicious domain AND command execution. Rotate every credential the affected build had access to and audit outbound DNS/network history from the build host. Related packages simple-date-formatter-util, -1, -2 (2026-08-02) also warrant lockfile audit
  8. 8Cluster G (5 internal-tooling singletons): any lockfile hit on accounts-final-form, accounts-loading-state, bigops-chat-messages, fluid-type-ui, or lifestyle-test-utils is a dep-confusion incident against a real internal tooling namespace. Confirm what the intended package was (frequently a scoped equivalent like @yourorg/accounts-final-form), delete the malicious resolution, and rotate every credential the build could reach
  9. 9For every npm install in CI, run with --ignore-scripts as defense-in-depth to prevent postinstall-triggered payloads from executing during dependency installation - but note this does NOT stop Cluster C @types-beta/sdk, which runs at import time
  10. 10Verify none of the 18 packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

References

Back to feedSubmit a correction
npm-2026-08-03-ghsa-malware-sweep