# GitHub Advisory npm CWE-506 sweep - 40+ package 2026-08-05 batch (massive Tinkoff Bank / dolyame BNPL / bnpl-blocks / tramvai / statist enterprise-scope dep-confusion burst, plus `clawtrl-wallet` crypto stealer + `sextant-cli-darwin-arm64` platform-binary + `@lizhao1/memorax-code-internal` + `@cliphijack/santaclaude` Claude-themed clipboard hijack + `llm-interceptor` + `multi-acct` + `kepler`)

> GHSA published 40+ npm CWE-506 advisories dated 2026-08-05 dominated by a massive **Tinkoff Bank (Russian bank) enterprise-scope dep-confusion burst**: `tinkoff-*`, `dolyame-boxy-*` (Tinkoff BNPL), `bnpl-blocks-atom-*`, `tramvai-*` (Tinkoff's open-source framework), `bigops-*`, `sme.rko.*` internal namespaces. Also `clawtrl-wallet` (crypto wallet stealer), `@cliphijack/santaclaude` (Claude-themed clipboard hijack), `sextant-cli-darwin-arm64`, `@lizhao1/memorax-code-internal`, `llm-interceptor`, `multi-acct`, `kepler`, `express-dever`, `svelte-mapped-metrics`, `streak-math-calc`, `streak-calc-metrics`, `svelte-mapping-core`, `eslint-plugin-vitest-ts`, `tailwindcss-scrollbar-hide`, `express-rate-controller`, `@stageflight-testbed/a`, `@workoscalif/sudoku`, `trapp-check-logs`, `sme-foundation-frame-manager`.

- Published: 2026-08-05
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 42 packages, 42 compromised versions
- Tags: dependency-confusion, ci-cd-compromise, credential-theft, crypto-wallet-drain, obfuscation
- Also known as: 2026-08-05 GHSA npm batch, Tinkoff Bank dep-confusion burst, Dolyame BNPL squat cluster, bnpl-blocks-atom cluster
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-08-05-ghsa-malware-sweep

## Affected packages (42)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@cliphijack/santaclaude](https://dependencywatch.io/package/npm/@cliphijack/santaclaude) | npm | 1.0.0 |
| [@ikbal_fadilah_vanexa01/vanexa-agent](https://dependencywatch.io/package/npm/@ikbal_fadilah_vanexa01/vanexa-agent) | npm | 1.0.0 |
| [@lizhao1/memorax-code-internal](https://dependencywatch.io/package/npm/@lizhao1/memorax-code-internal) | npm | 1.0.0 |
| [@stageflight-testbed/a](https://dependencywatch.io/package/npm/@stageflight-testbed/a) | npm | 1.0.0 |
| [@workoscalif/sudoku](https://dependencywatch.io/package/npm/@workoscalif/sudoku) | npm | 1.0.0 |
| [bigops-auth](https://dependencywatch.io/package/npm/bigops-auth) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-action-card](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-action-card) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-badge](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-badge) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-dolyame-button](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-dolyame-button) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-dropdown](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-dropdown) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-email-form](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-email-form) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-info-card](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-info-card) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-integrations-breadcrumbs](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-integrations-breadcrumbs) | npm | 1.0.0 |
| [bnpl-blocks-atom-bnpl-news-card](https://dependencywatch.io/package/npm/bnpl-blocks-atom-bnpl-news-card) | npm | 1.0.0 |
| [clawtrl-wallet](https://dependencywatch.io/package/npm/clawtrl-wallet) | npm | 1.0.0 |
| [dolyame-boxy-desktop-bnpl-text-block](https://dependencywatch.io/package/npm/dolyame-boxy-desktop-bnpl-text-block) | npm | 1.0.0 |
| [dolyame-boxy-fonts](https://dependencywatch.io/package/npm/dolyame-boxy-fonts) | npm | 1.0.0 |
| [dolyame-boxy-independent-bnpl-info-slider](https://dependencywatch.io/package/npm/dolyame-boxy-independent-bnpl-info-slider) | npm | 1.0.0 |
| [dolyame-boxy-independent-bnpl-items](https://dependencywatch.io/package/npm/dolyame-boxy-independent-bnpl-items) | npm | 1.0.0 |
| [dolyame-boxy-independent-bnpl-partners](https://dependencywatch.io/package/npm/dolyame-boxy-independent-bnpl-partners) | npm | 1.0.0 |
| [dolyame-boxy-independent-bnpl-picture-gallery](https://dependencywatch.io/package/npm/dolyame-boxy-independent-bnpl-picture-gallery) | npm | 1.0.0 |
| [dolyame-boxy-independent-bnpl-search](https://dependencywatch.io/package/npm/dolyame-boxy-independent-bnpl-search) | npm | 1.0.0 |
| [eslint-plugin-vitest-ts](https://dependencywatch.io/package/npm/eslint-plugin-vitest-ts) | npm | 1.0.0 |
| [express-dever](https://dependencywatch.io/package/npm/express-dever) | npm | 1.0.0 |
| [express-rate-controller](https://dependencywatch.io/package/npm/express-rate-controller) | npm | 1.0.0 |
| [kepler](https://dependencywatch.io/package/npm/kepler) | npm | 1.0.0 |
| [llm-interceptor](https://dependencywatch.io/package/npm/llm-interceptor) | npm | 1.0.0 |
| [multi-acct](https://dependencywatch.io/package/npm/multi-acct) | npm | 1.0.0 |
| [sextant-cli-darwin-arm64](https://dependencywatch.io/package/npm/sextant-cli-darwin-arm64) | npm | 1.0.0 |
| [sme-foundation-frame-manager](https://dependencywatch.io/package/npm/sme-foundation-frame-manager) | npm | 1.0.0 |
| [streak-calc-metrics](https://dependencywatch.io/package/npm/streak-calc-metrics) | npm | 1.0.0 |
| [streak-math-calc](https://dependencywatch.io/package/npm/streak-math-calc) | npm | 1.0.0 |
| [svelte-mapped-metrics](https://dependencywatch.io/package/npm/svelte-mapped-metrics) | npm | 1.0.0 |
| [svelte-mapping-core](https://dependencywatch.io/package/npm/svelte-mapping-core) | npm | 1.0.0 |
| [tailwindcss-scrollbar-hide](https://dependencywatch.io/package/npm/tailwindcss-scrollbar-hide) | npm | 1.0.0 |
| [tinkoff-pfp-block-desktop-tabs](https://dependencywatch.io/package/npm/tinkoff-pfp-block-desktop-tabs) | npm | 1.0.0 |
| [tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events](https://dependencywatch.io/package/npm/tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events) | npm | 1.0.0 |
| [tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events](https://dependencywatch.io/package/npm/tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events) | npm | 1.0.0 |
| [tinkoff-volna-zustate](https://dependencywatch.io/package/npm/tinkoff-volna-zustate) | npm | 1.0.0 |
| [tramvai-module-feature-toggle](https://dependencywatch.io/package/npm/tramvai-module-feature-toggle) | npm | 1.0.0 |
| [trapp-check-logs](https://dependencywatch.io/package/npm/trapp-check-logs) | npm | 1.0.0 |
| [vvvedernikov-test-another-test](https://dependencywatch.io/package/npm/vvvedernikov-test-another-test) | npm | 1.0.0 |

## What happened

On 2026-08-05, the GitHub Advisory Database published **40+ new npm CWE-506 (Embedded Malicious Code) advisories** dominated by a massive coordinated dep-confusion probe against Tinkoff Bank (JSC Tinkoff, one of Russia's largest banks) and its adjacent BNPL / SME / open-source-framework namespaces.

## Cluster A - Tinkoff Bank / dolyame BNPL / bnpl-blocks internal-namespace dep-confusion burst (25+ packages, 2026-08-05)

A precise dep-confusion probe against Tinkoff Bank internal engineering namespaces:

### Sub-cluster A.1 - Dolyame BNPL (Tinkoff's "buy-now-pay-later" product)

| Package | Notes |
|---|---|
| `dolyame-boxy-independent-bnpl-items` | BNPL items component |
| `dolyame-boxy-independent-bnpl-info-slider` | BNPL info slider |
| `dolyame-boxy-independent-bnpl-partners` | BNPL partners list |
| `dolyame-boxy-independent-bnpl-search` | BNPL search |
| `dolyame-boxy-independent-bnpl-picture-gallery` | BNPL image gallery |
| `dolyame-boxy-fonts` | Fonts bundle |
| `dolyame-boxy-desktop-bnpl-text-block` | BNPL text block |

### Sub-cluster A.2 - BNPL blocks atoms

| Package | Notes |
|---|---|
| `bnpl-blocks-atom-bnpl-email-form` | Email form |
| `bnpl-blocks-atom-bnpl-badge` | Badge atom |
| `bnpl-blocks-atom-bnpl-dropdown` | Dropdown atom |
| `bnpl-blocks-atom-bnpl-info-card` | Info card atom |
| `bnpl-blocks-atom-bnpl-news-card` | News card atom |
| `bnpl-blocks-atom-bnpl-integrations-breadcrumbs` | Breadcrumbs |
| `bnpl-blocks-atom-bnpl-dolyame-button` | Dolyame CTA button |
| `bnpl-blocks-atom-bnpl-action-card` | Action card |

### Sub-cluster A.3 - Tinkoff internal statist / SME / RKO client libraries

| Package | Notes |
|---|---|
| `tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events` | Statist browser event client |
| `tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events` | SME RKO mobile-pay event client |
| `tinkoff-pfp-block-desktop-tabs` | PFP block tabs |
| `tinkoff-volna-zustate` | Volna zustate |
| `tramvai-module-feature-toggle` | Tramvai (Tinkoff's open-source React framework) feature-toggle module |
| `sme-foundation-frame-manager` | SME foundation |
| `bigops-auth` | BigOps auth |

### Sub-cluster A.4 - Test / probe / other Tinkoff-adjacent

| Package | Notes |
|---|---|
| `vvvedernikov-test-another-test` | Developer-named test probe |
| `trapp-check-logs` | Trapp check logs |
| `@ikbal_fadilah_vanexa01/vanexa-agent` | Vanexa agent variant |
| `@stageflight-testbed/a` | Stageflight testbed |

The Cyrillic-transliteration name conventions (`dolyame` = Dolyame BNPL, `sme.rko` = SME / RKO cash management, `volna` = wave, `tramvai` = tram, `vvvedernikov` = a Russian surname pattern) plus the depth and breadth of internal-namespace coverage confirm this is a **targeted operation against Tinkoff Bank's internal npm registry**. The operator has clearly enumerated real Tinkoff internal package names from a leaked package manifest, an accidentally-public repo, or a scraped `package.json` from an internal Tinkoff project.

**Any Tinkoff Bank developer with a misconfigured `.npmrc` scope precedence** who ran `npm install` in the 2026-08-05 window could have resolved the malicious public versions instead of the internal legitimate ones. Given the specificity of the internal namespaces, the yield rate is likely high on any Tinkoff developer laptop or CI runner that hit the public registry for these names.

## Cluster B - `clawtrl-wallet` crypto-wallet stealer (1 package, 2026-08-05)

| Package | Notes |
|---|---|
| `clawtrl-wallet` | Explicit crypto-wallet-drain naming |

## Cluster C - `@cliphijack/santaclaude` Claude-themed clipboard hijack (1 package, 2026-08-05)

| Package | Notes |
|---|---|
| `@cliphijack/santaclaude` | Scope name telegraphs clipboard-hijack payload; Claude-themed package name for developer targeting |

Scope `@cliphijack` is an unusually direct payload-class signal - clipboard hijacking. Package name `santaclaude` is a Claude-themed mock/target aimed at developers searching for Claude Code utilities. Clipboard-hijack payloads typically monitor `pbcopy`/`xclip`/`xsel` output or hook browser clipboard events and **replace cryptocurrency addresses with attacker-controlled addresses at paste time** - so a developer copy-pasting a Bitcoin/Ethereum/Solana address to send funds ends up sending to the attacker's wallet instead. Any recent crypto transaction on a compromised host should be verified against the intended destination address.

## Cluster D - Platform-binary + internal-code cluster (2 packages, 2026-08-05)

| Package | Notes |
|---|---|
| `sextant-cli-darwin-arm64` | Apple Silicon platform-binary squat for a `sextant-cli` target |
| `@lizhao1/memorax-code-internal` | Internal-code shape suggests dep-confusion probe against `memorax` org |

## Cluster E - LLM / agent tooling (2 packages, 2026-08-05)

| Package | Notes |
|---|---|
| `llm-interceptor` | Generic LLM interceptor tool naming |
| `multi-acct` | Multi-account tooling naming |

## Cluster F - Framework / build-tool typosquats and misc long tail (2026-08-05)

`svelte-mapped-metrics`, `streak-math-calc`, `streak-calc-metrics`, `svelte-mapping-core`, `eslint-plugin-vitest-ts`, `tailwindcss-scrollbar-hide`, `express-dever`, `express-rate-controller`, `kepler`, `@workoscalif/sudoku`. Standard CWE-506 fully-compromised remediation applies.

## Registry state

All packages yanked / security-replaced from npm during the 2026-08-05 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Tinkoff / dolyame / BNPL cluster continues into 2026-08-06 (see `npm-2026-08-06-ghsa-malware-sweep` Cluster H sub-list) - the operator is running a multi-day enterprise-namespace enumeration burst against Tinkoff.
- `@cliphijack/santaclaude` matches the pattern of prior clipboard-hijack cryptocurrency-address-swap tools catalogued across recent months.
- No `threatActor` field set - GHSA advisories use OpenSSF `MAL-2026-*` identifiers only. The consistency and volume of the Tinkoff cluster is strong evidence of a single operator running a scripted enumeration campaign.

## Impact

- **Cluster A - Tinkoff Bank / dolyame BNPL / bnpl-blocks internal-namespace dep-confusion burst** (25+ packages, 2026-08-05): a coordinated dep-confusion probe against **Tinkoff Bank (JSC Tinkoff Bank, one of Russia's largest banks)** internal package namespaces. Squats include: `dolyame-boxy-*` (Dolyame is Tinkoff's BNPL "buy-now-pay-later" product), `bnpl-blocks-atom-bnpl-*` (BNPL React component atoms), `tinkoff-statist-browser-typed-client-sme.rko.*` (Tinkoff SME / RKO internal client libraries - RKO = Расчётно-Кассовое Обслуживание, cash-management for business accounts), `tramvai-module-feature-toggle` (Tramvai is Tinkoff's open-source React framework), `sme-foundation-frame-manager`, `bigops-*`. Any Tinkoff Bank developer whose local `.npmrc` or CI misconfigured the private registry preference could pull the malicious public versions
- **Cluster B - `clawtrl-wallet` crypto-wallet stealer** (1 package, 2026-08-05): explicit crypto-wallet-drain naming. Standard CWE-506 boilerplate applies but the name and single-version drop matches the profile of a targeted wallet-stealer package. Any host that installed should treat every crypto wallet on it as fully compromised
- **Cluster C - `@cliphijack/santaclaude` Claude-themed clipboard hijack** (1 package, 2026-08-05): scope `@cliphijack` telegraphs the payload class - clipboard hijacking. The `santaclaude` package name mocks Claude Code / Anthropic tooling, targeting developers searching for Claude-adjacent utilities. Clipboard hijack payloads typically replace cryptocurrency addresses copied to the clipboard with attacker-controlled addresses at paste time
- **Cluster D - Platform-binary + internal-code cluster** (2 packages, 2026-08-05): `sextant-cli-darwin-arm64` (Apple Silicon platform binary squat), `@lizhao1/memorax-code-internal` (internal-code package name shape suggests dep-confusion probe against a `memorax` org)
- **Cluster E - LLM / agent tooling** (2 packages, 2026-08-05): `llm-interceptor`, `multi-acct` - naming targets developers building LLM/AI tooling
- **Cluster F - Framework / build-tool typosquats** (5+ packages, 2026-08-05): `svelte-mapped-metrics`, `streak-math-calc`, `streak-calc-metrics`, `svelte-mapping-core`, `eslint-plugin-vitest-ts`, `tailwindcss-scrollbar-hide`, `express-dever`, `express-rate-controller`, `vvvedernikov-test-another-test`, `trapp-check-logs`, `kepler`, `@ikbal_fadilah_vanexa01/vanexa-agent`, `@stageflight-testbed/a`, `@workoscalif/sudoku`. Standard CWE-506 fully-compromised remediation applies
- All packages yanked / security-replaced from npm during the 2026-08-05 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-05 package list below - especially the Tinkoff / dolyame / bnpl-blocks / tramvai / sme.rko cluster
2. **For Tinkoff Bank / Tinkoff ecosystem developers**: this is a targeted enterprise-scope dep-confusion probe against your internal package namespaces. Audit `.npmrc` and `.yarnrc` files across all developer laptops and CI runners to confirm the private Tinkoff registry is set as the primary source with `always-auth=true`. Configure explicit `@dolyame:registry`, `@tinkoff:registry`, and `@sme.rko:registry` mappings if any exist. Add explicit `overrides` blocks in `package.json` for the specific package names above
3. For `clawtrl-wallet` matches: treat as a crypto-wallet stealer incident - move every crypto wallet balance to a fresh seed on an isolated host, rotate all seed phrases
4. For `@cliphijack/santaclaude` matches: check clipboard-related utilities that may have been auto-installed. **Any recent cryptocurrency transaction where you copy-pasted the destination address should be verified against the intended address** - clipboard-hijack payloads specifically swap crypto addresses at paste time
5. For `sextant-cli-darwin-arm64` matches: platform-binary distribution packages usually resolve via `optionalDependencies` + platform detection. Verify which real `sextant-cli` package your build was trying to install; the operator is squatting the Apple Silicon variant
6. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent preinstall/postinstall payloads from executing
7. Verify none of the 2026-08-05 packages still resolves via your private mirror

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-jh2q-fjxj-2jrr - dolyame-boxy-independent-bnpl-items malware advisory (Tinkoff BNPL dep-confusion)](https://github.com/advisories/GHSA-jh2q-fjxj-2jrr) - GitHub
- [GHSA-fm7r-fg6q-669q - tinkoff-volna-zustate malware advisory](https://github.com/advisories/GHSA-fm7r-fg6q-669q) - GitHub
- [GHSA-x32c-hhrc-xrc7 - tramvai-module-feature-toggle malware advisory (Tinkoff Tramvai framework)](https://github.com/advisories/GHSA-x32c-hhrc-xrc7) - GitHub
- [GHSA-2g3q-h5qx-j6f8 - bigops-auth malware advisory (Tinkoff BigOps namespace)](https://github.com/advisories/GHSA-2g3q-h5qx-j6f8) - GitHub
- [GHSA-fh5c-3w68-67m4 - clawtrl-wallet malware advisory (crypto wallet stealer)](https://github.com/advisories/GHSA-fh5c-3w68-67m4) - GitHub
- [GHSA-mfhm-5r65-895x - @cliphijack/santaclaude malware advisory (Claude-themed clipboard hijack)](https://github.com/advisories/GHSA-mfhm-5r65-895x) - GitHub
- [GHSA-2qg7-5p3x-vr75 - sextant-cli-darwin-arm64 malware advisory](https://github.com/advisories/GHSA-2qg7-5p3x-vr75) - GitHub
- [GHSA-6wxr-274h-wx32 - llm-interceptor malware advisory](https://github.com/advisories/GHSA-6wxr-274h-wx32) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-05-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-05-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).