# GitHub Advisory npm CWE-506 sweep - 18-package 2026-08-03 batch (`@types-beta/sdk@0.1.0-0.1.3` `@types`-namespace impersonation with Windows `nanocache.exe` WinHTTP-WebSocket RAT, 5-package `beaver-ui-*` component-library burst, `internallib_v524`/`v568` sequential dep-confusion continuation, `simple-date-formatter-new-1`/`-util-5` OpenSSF-PA C2 + command-execution pair, `tailwind-anim` Tailwind-ecosystem typosquat second-day companion, `@custombots/custombot@1.0.0` OpenSSF-PA malicious-command scoped RAT, and 5-package internal-tooling dep-confusion singleton burst)

> GHSA published 18 npm CWE-506 advisories dated 2026-08-03. Most severe: `@types-beta/sdk@0.1.0-0.1.3` - a `@types`-namespace impersonation embedding a Windows `nanocache.exe` WinHTTP WebSocket RAT. Batch also includes a 5-package `beaver-ui-*` dep-confusion burst, `internallib_v524/v568` continuation, `simple-date-formatter-*` OpenSSF-PA C2+cmd pair, `tailwind-anim`, and 5 more.

- Published: 2026-08-03
- Last updated: 2026-08-04
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 17 packages, 20 compromised versions
- Tags: typosquat, dependency-confusion, ci-cd-compromise, credential-theft, infostealer, account-takeover
- Also known as: 2026-08-03 GHSA npm batch, tailwind-anim typosquat, @custombots scoped RAT, @types-beta/sdk nanocache.exe RAT, beaver-ui component-library dep-confusion burst, internallib_v<NNN> sequential enumeration, simple-date-formatter continuation
- Detected by: GitHub Advisory Database, OpenSSF Package Analysis, npm Security, codelake Research
- Incident ID: npm-2026-08-03-ghsa-malware-sweep

## Affected packages (17)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@custombots/custombot](https://dependencywatch.io/package/npm/@custombots/custombot) | npm | 1.0.0 |
| [@types-beta/sdk](https://dependencywatch.io/package/npm/@types-beta/sdk) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3 |
| [accounts-final-form](https://dependencywatch.io/package/npm/accounts-final-form) | npm | 1.0.0 |
| [accounts-loading-state](https://dependencywatch.io/package/npm/accounts-loading-state) | npm | 1.0.0 |
| [beaver-ui-date-range-picker](https://dependencywatch.io/package/npm/beaver-ui-date-range-picker) | npm | 1.0.0 |
| [beaver-ui-grid](https://dependencywatch.io/package/npm/beaver-ui-grid) | npm | 1.0.0 |
| [beaver-ui-header](https://dependencywatch.io/package/npm/beaver-ui-header) | npm | 1.0.0 |
| [beaver-ui-items-with-more](https://dependencywatch.io/package/npm/beaver-ui-items-with-more) | npm | 1.0.0 |
| [beaver-ui-layout](https://dependencywatch.io/package/npm/beaver-ui-layout) | npm | 1.0.0 |
| [bigops-chat-messages](https://dependencywatch.io/package/npm/bigops-chat-messages) | npm | 1.0.0 |
| [fluid-type-ui](https://dependencywatch.io/package/npm/fluid-type-ui) | npm | 1.0.0 |
| [internallib_v524](https://dependencywatch.io/package/npm/internallib_v524) | npm | 1.0.0 |
| [internallib_v568](https://dependencywatch.io/package/npm/internallib_v568) | npm | 1.0.0 |
| [lifestyle-test-utils](https://dependencywatch.io/package/npm/lifestyle-test-utils) | npm | 1.0.0 |
| [simple-date-formatter-new-1](https://dependencywatch.io/package/npm/simple-date-formatter-new-1) | npm | 1.0.0 |
| [simple-date-formatter-util-5](https://dependencywatch.io/package/npm/simple-date-formatter-util-5) | npm | 1.0.0 |
| [tailwind-anim](https://dependencywatch.io/package/npm/tailwind-anim) | npm | 1.0.0 |

## What happened

On 2026-08-03, the GitHub Advisory Database published **18 new npm CWE-506 (Embedded Malicious Code) advisories** in a same-day burst. This module catalogues that batch. Larger than the 8-package 2026-08-02 batch and dominated by a Windows RAT payload (`@types-beta/sdk`), a 5-package component-library dep-confusion burst (`beaver-ui-*`), and continuation of the `simple-date-formatter-*` and `internallib_*` operator lanes seen the previous day.

## Cluster A - `tailwind-anim` Tailwind-ecosystem typosquat (1 package, 2026-08-03)

| Package | Notes |
|---|---|
| `tailwind-anim` | typosquat against `tailwindcss-animate` (~1.7M weekly downloads), same-operator second-day companion to `tailwindcss-anim` |

GHSA-7xhc-fvmj-h5xj carries the standard CWE-506 boilerplate. The `tailwind-anim` name shape is the **shortest natural autocomplete-truncation misspelling** of the highly-popular legitimate `tailwindcss-animate` plugin - drops both the `css` connector and the `-ate` suffix.

This is a **same-operator second-day companion** to the 2026-08-02 `tailwindcss-anim` variant (see `npm-2026-08-02-ghsa-malware-sweep` Cluster C). Two variants published on adjacent days covering the two most common autocomplete-truncation misspellings of `tailwindcss-animate`.

## Cluster B - `@custombots/custombot@1.0.0` OpenSSF-PA scoped RAT (1 package, 2026-08-03)

| Package | Version | Notes |
|---|---|---|
| `@custombots/custombot` | `1.0.0` | OpenSSF PA: "executes one or more commands associated with malicious behavior" - scoped RAT under attacker-controlled `@custombots` scope |

GHSA-77jv-xw6r-q246 records OpenSSF Package Analysis flagged the tarball because it **"executes one or more commands associated with malicious behavior"** - active command execution observed at analysis time, not merely static-metadata heuristics.

Attacker-controlled `@custombots` scope with a `custombot` sub-name. Multiple small SaaS platforms operate under the "CustomBots" brand (Discord bot builders, WhatsApp chatbot platforms, no-code automation) - the malicious scope is plausibly a **targeted publish against organisations that maintain internal `@custombots/*` chatbot / bot-builder / automation tooling** as private npm packages.

## Cluster C - `@types-beta/sdk@0.1.0-0.1.3` `@types`-namespace impersonation with Windows nanocache.exe WinHTTP RAT (1 package, 4 versions, 2026-08-03)

| Package | Versions | Notes |
|---|---|---|
| `@types-beta/sdk` | `0.1.0`, `0.1.1`, `0.1.2`, `0.1.3` | `@types`-namespace impersonation; embedded Windows `vendor/nanocache.exe`; WinHTTP WebSocket RAT; import-time side effect |

**Most severe payload in the 2026-08-03 batch.** GHSA-j9jc-8h3g-qqrx records that `@types-beta/sdk` is a supply-chain dropper masquerading as a legitimate type-definition library from the trusted-looking `@types-beta` scope.

Full behaviour chain per the advisory:

1. **Embedded Windows PE**: bundles `vendor/nanocache.exe` inside the tarball.
2. **Import-time execution**: spawns the binary via Node's `child_process` **as an import-time side effect on Windows** - NOT a postinstall hook. Running `npm install --ignore-scripts` does NOT stop it. Any `require("@types-beta/sdk")` or ESM `import` triggers spawn.
3. **WinHTTP WebSocket RAT**: the binary implements a WinHTTP WebSocket agent that "dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel".
4. **Interactive command execution**: the RAT executes remote commands and initiates interactive PowerShell sessions (`[>] cmd: %s`).
5. **Resilience**: automatic reconnection.

**Detection credited to codelake Research** monitoring the live npm feed.

The **4 sequential versions** `0.1.0`, `0.1.1`, `0.1.2`, `0.1.3` indicate the operator iterated on the payload during the drop window - likely refining evasion or payload behaviour before takedown. All 4 versions carry the same malicious tarball shape.

The **`@types-beta` scope is NOT an official DefinitelyTyped sub-scope** - the legitimate npm namespace for community TypeScript type definitions is exactly `@types/*` (not `@types-something/*`). `@types-beta` is a deliberate visual near-collision designed to catch a developer who half-remembers a "beta types SDK" and grabs the first result. Consumers should audit `.npmrc` for any misconfigured trust of `@types-beta` and treat any inclusion as an intrusion.

## Cluster D - 5-package `beaver-ui-*` component-library dep-confusion burst (5 packages, 2026-08-03)

| Package | Notes |
|---|---|
| `beaver-ui-items-with-more` | component library - "items with more" overflow chip |
| `beaver-ui-header` | component library - header |
| `beaver-ui-date-range-picker` | component library - date range picker |
| `beaver-ui-layout` | component library - layout primitive |
| `beaver-ui-grid` | component library - grid primitive |

Same-day coordinated publish of 5 packages under a shared `beaver-ui-<component>` naming template. All 5 GHSA advisories carry the standard CWE-506 boilerplate with no per-package behaviour prose.

The **5-name shape covers the standard component-library taxonomy** (grid, layout, header, date-range-picker, items-with-more overflow chip). This is the canonical shape of a **dependency-confusion component-library burst**: an operator enumerates the highest-probability internal component names of any org that maintains an internal `@beaver-ui/*` or `beaver-ui-*` React / Vue / Angular design system. If any target org publishes even one component under this name shape internally, the burst will catch it.

Multiple small companies and product teams brand internal design systems as "Beaver UI" (the animal-name design-system naming convention is popular - Panda CSS, Chakra UI, Ant Design, Radix, etc.). The operator is casting a wide net across real corporate internal namespaces.

## Cluster E - `internallib_v524`/`v568` sequential dep-confusion continuation (2 packages, 2026-08-03; paired with `v688` on 08-04)

| Package | Notes |
|---|---|
| `internallib_v524` | `internallib_v<NNN>` sequential dep-confusion probe |
| `internallib_v568` | `internallib_v<NNN>` sequential dep-confusion probe |

Both advisories carry standard CWE-506 boilerplate. The `internallib_v<NNN>` naming template is a **canonical dep-confusion probe against orgs that publish internal `internallib_*` packages** to their private registry - the `internal` prefix is an explicit tell.

**Adjacent-day continuation**: the operator dropped `internallib_v688` on 2026-08-04 (see `npm-2026-08-04-ghsa-malware-sweep`), suggesting a numeric-suffix enumeration loop where the operator publishes fresh `v<NNN>` versions periodically to catch any misconfigured internal registry that resolves the higher public version over the internal one.

The non-sequential jumps (`v524`, `v568`, `v688`) suggest the operator is not enumerating exhaustively but sampling ranges - possibly correlated to real version numbers observed in leaked or scraped internal package manifests.

## Cluster F - `simple-date-formatter-new-1`/`-util-5` OpenSSF-PA C2 + command-execution pair (2 packages, 2026-08-03)

| Package | Notes |
|---|---|
| `simple-date-formatter-new-1` | OpenSSF PA: malicious-domain communication + malicious-command execution |
| `simple-date-formatter-util-5` | OpenSSF PA: malicious-domain communication + malicious-command execution |

Both GHSA-83gm-93p7-wh7r and GHSA-rhm2-fwx3-922c carry **specific OpenSSF Package Analysis dynamic-analysis prose**:

> "The package communicates with a domain associated with malicious activity."
> "The package executes one or more commands associated with malicious behavior."

Two distinct dynamic-analysis signals per package - active outbound C2 traffic AND command execution observed at analysis time. This is a **direct continuation** of the `simple-date-formatter-util` + `-1` + `-2` trio catalogued in the 2026-08-02 batch (see `npm-2026-08-02-ghsa-malware-sweep` Cluster B).

The operator **escalated behaviour**: on 2026-08-02 the trio carried only generic CWE-506 boilerplate; on 2026-08-03 the new drops carry confirmed dynamic-analysis C2 + command-execution. Either the payload changed between drops, or OpenSSF PA analysis caught up to the earlier drops in a later scan - either way the whole `simple-date-formatter-*` operator lane is now confirmed as an active-C2 dropper.

## Cluster G - 5-package internal-tooling dep-confusion singleton burst (5 packages, 2026-08-03)

| Package | Notes |
|---|---|
| `accounts-final-form` | internal-tooling name shape - `react-final-form` accounts wrapper |
| `accounts-loading-state` | internal-tooling name shape - accounts UI loading state |
| `bigops-chat-messages` | internal-tooling name shape - BigOps observability / chat integration |
| `fluid-type-ui` | internal-tooling name shape - fluid-typography design-system primitive |
| `lifestyle-test-utils` | internal-tooling name shape - Lifestyle-brand internal test tooling |

Same-day drop of 5 unrelated singletons all shaped as **internal-tooling package names**. All 5 GHSA advisories carry the standard CWE-506 boilerplate with no per-package behaviour prose.

- `accounts-final-form` and `accounts-loading-state` share an `accounts-*` prefix consistent with an internal auth / user-management module namespace at a real target org.
- `bigops-chat-messages` references the "BigOps" brand (BigOps.io, an observability / SRE tooling vendor) - plausibly targeting an internal chat-integration module.
- `fluid-type-ui` matches the "fluid typography" design-system idiom used in Bootstrap 5, Tailwind Fluid Typography, and similar toolkits.
- `lifestyle-test-utils` reads as a brand-scoped internal test-utils package (multiple lifestyle-brand companies publish npm packages).

This matches the wider **enterprise/vendor-scope brand-impersonation sweep** pattern documented across the 2026-07-2x through 2026-08-0x batches (`@finance-ui`, `@spending-behavior-ui`, `@meli-testing`, `@cr-invested-ui-components`, `@moxfive-llc/common`, `@custombots/custombot`, etc.). The operator is enumerating plausibly-unique internal-tooling names hoping any real org has misconfigured `.npmrc` scope precedence.

## Registry state

All 18 packages security-replaced during the 2026-08-03 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Cluster A `tailwind-anim` is the same-operator second-day companion to `tailwindcss-anim` catalogued in `npm-2026-08-02-ghsa-malware-sweep` Cluster C - treat as a single logical typosquat campaign against `tailwindcss-animate`.
- Cluster B `@custombots/custombot` and Cluster G singletons together extend the enterprise-scope brand-impersonation sweep catalogued in `npm-2026-07-31-ghsa-malware-sweep` Cluster G and the 2026-08-01 `@moxfive-llc/common` scoped RAT.
- Cluster C `@types-beta/sdk` is the highest-severity new payload of the 2026-08-03 batch - a genuine active-C2 Windows RAT under a `@types`-namespace impersonation is qualitatively distinct from the CWE-506-boilerplate mass drops. Compare to the earlier `@types-registry/*` and `@types-node-*` typosquat clusters that historically leverage the `@types/*` scope trust.
- Cluster E `internallib_v524/v568` pairs with `internallib_v688` on 2026-08-04 - same operator, sequential-numeric enumeration campaign against `internallib_*` internal packages.
- Cluster F `simple-date-formatter-*` continuation confirms the `simple-date-formatter-util` operator lane is an active-C2 dropper, not just researcher noise.
- Detection for Cluster C is credited to **codelake Research** - a new research entity showing up in the 2026 npm-malware detection landscape.
- No `threatActor` field is set - GHSA advisories in this batch use only CWE-506 boilerplate / OpenSSF-PA autotriage prose / codelake Research detection prose with no named actor attribution.

## Impact

- Any host that installed any of the 18 npm packages listed below should be treated as fully compromised - every GHSA advisory uses the CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer") and no patched version exists. Two clusters carry additional dynamic-analysis prose: Cluster C `@types-beta/sdk` is a **live Windows RAT** and Cluster F `simple-date-formatter-*` has OpenSSF-PA C2 + command-execution flags
- **Cluster A - `tailwind-anim` Tailwind-ecosystem typosquat second-day companion** (1 package, `>= 0`, 2026-08-03): `tailwind-anim`. Direct autocomplete-truncation typosquat against the ~1.7M-weekly-download legitimate `tailwindcss-animate` - the `tailwind-anim` form drops both the `css` connector and the `-ate` suffix. Same-operator counterpart to `tailwindcss-anim` published one day earlier under the 2026-08-02 batch (see `npm-2026-08-02-ghsa-malware-sweep` Cluster C)
- **Cluster B - `@custombots/custombot@1.0.0` OpenSSF-PA malicious-command-execution scoped RAT** (1 package, `= 1.0.0`, 2026-08-03): `@custombots/custombot`. GHSA-77jv-xw6r-q246 records OpenSSF Package Analysis flagged the tarball for "executes one or more commands associated with malicious behavior" - active command execution observed at analysis time. Attacker-controlled `@custombots` scope catches any org that maintains internal `@custombots/*` chatbot / Discord-bot / automation tooling and misconfigures `.npmrc` scope precedence
- **Cluster C - `@types-beta/sdk@0.1.0-0.1.3` `@types`-namespace impersonation with Windows nanocache.exe RAT** (1 package, 4 versions `0.1.0`, `0.1.1`, `0.1.2`, `0.1.3`, 2026-08-03): `@types-beta/sdk`. GHSA-j9jc-8h3g-qqrx records that the tarball is a supply-chain dropper masquerading as a legitimate type-definition library from the trusted-looking `@types-beta` scope. Bundles `vendor/nanocache.exe` (Windows PE) and spawns it via `child_process` as an **import-time side effect** (not a postinstall hook - `--ignore-scripts` does NOT stop it), implements a **WinHTTP WebSocket-based RAT** that "dials out to a command-and-control server and maintains a persistent, auto-reconnecting channel", executes remote commands, and initiates interactive PowerShell sessions. Detection credited to **codelake Research** monitoring the live npm feed. The 4 sequential versions `0.1.0` through `0.1.3` indicate the operator iterated on the payload during the drop window before takedown
- **Cluster D - 5-package `beaver-ui-*` component-library burst** (5 packages, all `>= 0`, all 2026-08-03): `beaver-ui-items-with-more`, `beaver-ui-header`, `beaver-ui-date-range-picker`, `beaver-ui-layout`, `beaver-ui-grid`. Same-day coordinated publish of 5 packages under a shared `beaver-ui-<component>` naming template - canonical **dependency-confusion component-library burst** targeting orgs that maintain an internal `@beaver-ui/*` or `beaver-ui-*` React / Vue / Angular design system (a common internal-tooling brand). All 5 names cover the standard component-library taxonomy (grid, layout, header, date-range-picker, items-with-more) - the operator is enumerating high-probability internal component names to maximise dep-confusion hits across any real internal `beaver-ui` design system
- **Cluster E - `internallib_v524`/`v568` sequential dep-confusion continuation** (2 packages, both `>= 0`, both 2026-08-03; paired with `internallib_v688` on 2026-08-04): `internallib_v524`, `internallib_v568`. The `internallib_v<NNN>` naming template is the canonical **dep-confusion probe against orgs that publish internal `internallib_*` scoped or unscoped packages to their private registry**. Adjacent-day drops with fresh numeric suffixes (`v524`, `v568`, `v688` on 08-04) indicate an operator running a numeric-suffix enumeration loop against the public registry - every fresh `v<NNN>` version is a new attempt to catch an internal-registry misconfiguration
- **Cluster F - `simple-date-formatter-new-1`/`-util-5` OpenSSF-PA C2 + command-execution pair** (2 packages, both `>= 0`, both 2026-08-03): `simple-date-formatter-new-1`, `simple-date-formatter-util-5`. Both GHSA-83gm-93p7-wh7r and GHSA-rhm2-fwx3-922c carry **specific OpenSSF Package Analysis dynamic-analysis prose**: "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior" - active outbound C2 traffic plus command execution observed at analysis time. Direct continuation of the `simple-date-formatter-util` + `-1` + `-2` trio catalogued in the 2026-08-02 batch (see `npm-2026-08-02-ghsa-malware-sweep` Cluster B) - the operator escalated from generic CWE-506 boilerplate on 08-02 to confirmed dynamic-analysis C2 + command-exec behaviour on 08-03
- **Cluster G - 5-package internal-tooling dep-confusion singleton burst** (5 packages, all `>= 0`, all 2026-08-03): `accounts-final-form`, `accounts-loading-state`, `bigops-chat-messages`, `fluid-type-ui`, `lifestyle-test-utils`. Same-day drop of 5 unrelated singletons all shaped as **internal-tooling package names**: `accounts-*` (auth / user-management), `bigops-chat-messages` (BigOps observability / chat integration), `fluid-type-ui` (fluid-typography design-system component), `lifestyle-test-utils` (Lifestyle brand internal test tooling). All match the pattern of small companies / product teams that publish an internal design-system component or shared library under a plausibly-unique but not-actually-unique name - the operator is running a **wide dep-confusion sweep against real corporate internal namespaces** in the hope that at least one target org has misconfigured `.npmrc` scope precedence
- None of the 18 packages retain original tarballs on the public npm registry - all replaced with security sentinels during takedown. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. **Cluster C (`@types-beta/sdk`) - CRITICAL Windows RAT**: any lockfile hit at any of `0.1.0`, `0.1.1`, `0.1.2`, `0.1.3` - **treat every Windows host that imported this package as fully compromised with an active RAT**. The `nanocache.exe` payload executes as an **import-time side effect via `child_process`, NOT a postinstall hook** - running with `npm install --ignore-scripts` does NOT prevent execution. Any dev workstation, CI runner, or production host that ran `require("@types-beta/sdk")` or `import "@types-beta/sdk"` has spawned the RAT. Kill any `nanocache.exe` process on the host, revoke any WinHTTP outbound connections to unknown domains, rotate every credential the host had access to, re-image, and audit outbound network history from the host for WebSocket connections to unknown domains. The `@types-beta` scope is NOT an official `@types/*` sub-scope - the legitimate DefinitelyTyped scope is `@types/*` - audit `.npmrc` for any misconfigured trust of `@types-beta`
3. **Cluster A (`tailwind-anim`)**: any lockfile hit is a Tailwind-ecosystem typosquat incident targeting `tailwindcss-animate` (~1.7M weekly downloads). Confirm the intended package (typically `tailwindcss-animate` or `tailwindcss-animated`), delete the malicious `tailwind-anim` resolution, and rotate every credential the build could reach
4. **Cluster B (`@custombots/custombot@1.0.0`)**: any lockfile hit is a supply-chain incident - OpenSSF PA flagged live command execution. Orgs that maintain internal `@custombots/*` tooling: configure `.npmrc` scope-to-registry mapping so `@custombots` resolves to a trusted internal registry, or add an explicit `overrides` block in `package.json`
5. **Cluster D (`beaver-ui-*` 5-package burst)**: any lockfile hit on any of the 5 `beaver-ui-*` names is a dependency-confusion incident targeting an internal `beaver-ui` design system. Orgs that maintain a real internal `beaver-ui` or `@beaver-ui/*` component library: configure `.npmrc` scope-to-registry mapping (if scoped) or use `overrides` to block the public-registry versions from resolving. Audit outbound network from any build host that resolved any of the 5 in the last 72h
6. **Cluster E (`internallib_v524`/`v568`)**: any lockfile hit is a dep-confusion incident targeting orgs that publish `internallib_v<NNN>` internal packages. The `internallib_` prefix is a strong internal-package name shape - configure `.npmrc` scope precedence or `overrides` block. The paired `internallib_v688` variant on 2026-08-04 (see `npm-2026-08-04-ghsa-malware-sweep`) uses the same enumeration lane
7. **Cluster F (`simple-date-formatter-new-1`/`-util-5`)**: any lockfile hit - OpenSSF PA specifically flagged outbound traffic to a malicious domain AND command execution. Rotate every credential the affected build had access to and audit outbound DNS/network history from the build host. Related packages `simple-date-formatter-util`, `-1`, `-2` (2026-08-02) also warrant lockfile audit
8. **Cluster G (5 internal-tooling singletons)**: any lockfile hit on `accounts-final-form`, `accounts-loading-state`, `bigops-chat-messages`, `fluid-type-ui`, or `lifestyle-test-utils` is a dep-confusion incident against a real internal tooling namespace. Confirm what the intended package was (frequently a scoped equivalent like `@yourorg/accounts-final-form`), delete the malicious resolution, and rotate every credential the build could reach
9. For every npm install in CI, run with `--ignore-scripts` as defense-in-depth to prevent postinstall-triggered payloads from executing during dependency installation - but note this does NOT stop Cluster C `@types-beta/sdk`, which runs at import time
10. Verify none of the 18 packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GHSA-7xhc-fvmj-h5xj - tailwind-anim malware advisory (Tailwind CSS ecosystem typosquat)](https://github.com/advisories/GHSA-7xhc-fvmj-h5xj) - GitHub
- [GHSA-77jv-xw6r-q246 - @custombots/custombot malware advisory (OpenSSF PA malicious-command-execution scoped RAT)](https://github.com/advisories/GHSA-77jv-xw6r-q246) - GitHub
- [GHSA-j9jc-8h3g-qqrx - @types-beta/sdk malware advisory (@types-namespace impersonation, Windows nanocache.exe WinHTTP WebSocket RAT)](https://github.com/advisories/GHSA-j9jc-8h3g-qqrx) - GitHub
- [GHSA-qq8g-w3r7-rqp8 - beaver-ui-items-with-more malware advisory](https://github.com/advisories/GHSA-qq8g-w3r7-rqp8) - GitHub
- [GHSA-qm7r-x5cp-5wc2 - beaver-ui-header malware advisory](https://github.com/advisories/GHSA-qm7r-x5cp-5wc2) - GitHub
- [GHSA-x5q8-8mg7-8jvg - beaver-ui-date-range-picker malware advisory](https://github.com/advisories/GHSA-x5q8-8mg7-8jvg) - GitHub
- [GHSA-w259-8g6c-8ppr - beaver-ui-layout malware advisory](https://github.com/advisories/GHSA-w259-8g6c-8ppr) - GitHub
- [GHSA-xjhx-6v3c-9cqp - beaver-ui-grid malware advisory](https://github.com/advisories/GHSA-xjhx-6v3c-9cqp) - GitHub
- [GHSA-2wgh-22xm-wp5f - internallib_v524 malware advisory (dep-confusion continuation)](https://github.com/advisories/GHSA-2wgh-22xm-wp5f) - GitHub
- [GHSA-f4rq-x75f-gx73 - internallib_v568 malware advisory (dep-confusion continuation)](https://github.com/advisories/GHSA-f4rq-x75f-gx73) - GitHub
- [GHSA-83gm-93p7-wh7r - simple-date-formatter-new-1 malware advisory (OpenSSF PA C2 + command exec)](https://github.com/advisories/GHSA-83gm-93p7-wh7r) - GitHub
- [GHSA-rhm2-fwx3-922c - simple-date-formatter-util-5 malware advisory (OpenSSF PA C2 + command exec)](https://github.com/advisories/GHSA-rhm2-fwx3-922c) - GitHub
- [GHSA-2rrw-8g3r-w44h - accounts-final-form malware advisory](https://github.com/advisories/GHSA-2rrw-8g3r-w44h) - GitHub
- [GHSA-9pwq-f6rq-8q69 - accounts-loading-state malware advisory](https://github.com/advisories/GHSA-9pwq-f6rq-8q69) - GitHub
- [GHSA-7fcf-754p-pfhv - bigops-chat-messages malware advisory](https://github.com/advisories/GHSA-7fcf-754p-pfhv) - GitHub
- [GHSA-4w4v-pw3v-q85q - fluid-type-ui malware advisory](https://github.com/advisories/GHSA-4w4v-pw3v-q85q) - GitHub
- [GHSA-5f9f-jfwr-xxvp - lifestyle-test-utils malware advisory](https://github.com/advisories/GHSA-5f9f-jfwr-xxvp) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-03-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-03-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).