# GitHub Advisory npm CWE-506 sweep - 50+ package 2026-08-06 batch (Sui-blockchain `sui-migration-audit-*` + `move-bcs-codec` cluster, `@activepieces/piece-*` typosquat sweep, `@ccfly/setup-*` platform-binary quartet, `@addai/*` cluster, `claude-remote-agent` RAT, `diezyyasha-baileys` + `alipclutch-baileys` WhatsApp cluster, `@holocronlab/botruntime-runtime` bot-framework masquerade, `helmet-pro` + `agenttunnels` + `agenthub-multiagent-mcp` + `typst-resume-cli` misc)

> GHSA published 50+ npm CWE-506 advisories dated 2026-08-06 spanning several clusters: Sui blockchain tooling (`sui-migration-audit-cli`, `sui-graphql-client`, `sui-migration-audit-rules`, `move-bcs-codec`), an `@activepieces/piece-*` typosquat sweep (`piece-google-contacts`, `piece-google-bigquery`, `piece-google-forms`, `piece-base44`), a `@ccfly/setup-*` platform-binary quartet (`darwin-arm64`, `darwin-x64`, `linux-arm64`, `linux-x64`), an `@addai/*` cluster (`ainode`, `node`, `entity-runtime`), `claude-remote-agent` RAT, WhatsApp `diezyyasha-baileys` + `alipclutch-baileys` sibling clones, `@holocronlab/botruntime-runtime` bot framework masquerade, and a long tail of enterprise-scope dep-confusion probes.

- Published: 2026-08-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 58 packages, 58 compromised versions
- Tags: credential-theft, dependency-confusion, ci-cd-compromise, crypto-wallet-drain, account-takeover, obfuscation
- Also known as: 2026-08-06 GHSA npm batch, Sui developer supply-chain attack, @activepieces piece takeover cluster, @ccfly setup platform-binary quartet
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security
- Incident ID: npm-2026-08-06-ghsa-malware-sweep

## Affected packages (58)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@0l00000l/auth](https://dependencywatch.io/package/npm/@0l00000l/auth) | npm | 1.0.0 |
| [@activepieces/piece-base44](https://dependencywatch.io/package/npm/@activepieces/piece-base44) | npm | 1.0.0 |
| [@activepieces/piece-google-bigquery](https://dependencywatch.io/package/npm/@activepieces/piece-google-bigquery) | npm | 1.0.0 |
| [@activepieces/piece-google-contacts](https://dependencywatch.io/package/npm/@activepieces/piece-google-contacts) | npm | 1.0.0 |
| [@activepieces/piece-google-forms](https://dependencywatch.io/package/npm/@activepieces/piece-google-forms) | npm | 1.0.0 |
| [@addai/ainode](https://dependencywatch.io/package/npm/@addai/ainode) | npm | 1.0.0 |
| [@addai/entity-runtime](https://dependencywatch.io/package/npm/@addai/entity-runtime) | npm | 1.0.0 |
| [@addai/node](https://dependencywatch.io/package/npm/@addai/node) | npm | 1.0.0 |
| [@apicity/meta](https://dependencywatch.io/package/npm/@apicity/meta) | npm | 1.0.0 |
| [@astralcore/aura-wb](https://dependencywatch.io/package/npm/@astralcore/aura-wb) | npm | 1.0.0 |
| [@atom8n/inspector](https://dependencywatch.io/package/npm/@atom8n/inspector) | npm | 1.0.0 |
| [@aubea/mars](https://dependencywatch.io/package/npm/@aubea/mars) | npm | 1.0.0 |
| [@bananacool467/ui-tools](https://dependencywatch.io/package/npm/@bananacool467/ui-tools) | npm | 1.0.0 |
| [@ccfly/setup-darwin-arm64](https://dependencywatch.io/package/npm/@ccfly/setup-darwin-arm64) | npm | 1.0.0 |
| [@ccfly/setup-darwin-x64](https://dependencywatch.io/package/npm/@ccfly/setup-darwin-x64) | npm | 1.0.0 |
| [@ccfly/setup-linux-arm64](https://dependencywatch.io/package/npm/@ccfly/setup-linux-arm64) | npm | 1.0.0 |
| [@ccfly/setup-linux-x64](https://dependencywatch.io/package/npm/@ccfly/setup-linux-x64) | npm | 1.0.0 |
| [@chnayser/server](https://dependencywatch.io/package/npm/@chnayser/server) | npm | 1.0.0 |
| [@holocronlab/botruntime-runtime](https://dependencywatch.io/package/npm/@holocronlab/botruntime-runtime) | npm | 1.0.0 |
| [@innocarpe/deepseek-build](https://dependencywatch.io/package/npm/@innocarpe/deepseek-build) | npm | 1.0.0 |
| [@leejungkiin/awkit](https://dependencywatch.io/package/npm/@leejungkiin/awkit) | npm | 1.0.0 |
| [@love-moon/conductor-cli](https://dependencywatch.io/package/npm/@love-moon/conductor-cli) | npm | 1.0.0 |
| [@trackunit/iris-app-sdk-vite](https://dependencywatch.io/package/npm/@trackunit/iris-app-sdk-vite) | npm | 1.0.0 |
| [@vanexalabs-ai/vanexa-agent](https://dependencywatch.io/package/npm/@vanexalabs-ai/vanexa-agent) | npm | 1.0.0 |
| [@xiaohhhh1/canvas-agent](https://dependencywatch.io/package/npm/@xiaohhhh1/canvas-agent) | npm | 1.0.0 |
| [9remote](https://dependencywatch.io/package/npm/9remote) | npm | 1.0.0 |
| [agenthub-multiagent-mcp](https://dependencywatch.io/package/npm/agenthub-multiagent-mcp) | npm | 1.0.0 |
| [agenttunnels](https://dependencywatch.io/package/npm/agenttunnels) | npm | 1.0.0 |
| [alipclutch-baileys](https://dependencywatch.io/package/npm/alipclutch-baileys) | npm | 1.0.0 |
| [app-api-sdk](https://dependencywatch.io/package/npm/app-api-sdk) | npm | 1.0.0 |
| [beautiful-ui-monitoring](https://dependencywatch.io/package/npm/beautiful-ui-monitoring) | npm | 1.0.0 |
| [bigops-tcrm-permissions](https://dependencywatch.io/package/npm/bigops-tcrm-permissions) | npm | 1.0.0 |
| [claude-remote-agent](https://dependencywatch.io/package/npm/claude-remote-agent) | npm | 1.0.0 |
| [devplatform-data-table](https://dependencywatch.io/package/npm/devplatform-data-table) | npm | 1.0.0 |
| [devplatform-jscodeshift-utils](https://dependencywatch.io/package/npm/devplatform-jscodeshift-utils) | npm | 1.0.0 |
| [devplatform-spa-plugin-error-boundary](https://dependencywatch.io/package/npm/devplatform-spa-plugin-error-boundary) | npm | 1.0.0 |
| [devplatform-vite-plugin-gle](https://dependencywatch.io/package/npm/devplatform-vite-plugin-gle) | npm | 1.0.0 |
| [diezyyasha-baileys](https://dependencywatch.io/package/npm/diezyyasha-baileys) | npm | 1.0.0 |
| [ezdiscordbots](https://dependencywatch.io/package/npm/ezdiscordbots) | npm | 1.0.0 |
| [fetchrtds](https://dependencywatch.io/package/npm/fetchrtds) | npm | 1.0.0 |
| [helmet-pro](https://dependencywatch.io/package/npm/helmet-pro) | npm | 1.0.0 |
| [jagproject](https://dependencywatch.io/package/npm/jagproject) | npm | 1.0.0 |
| [move-bcs-codec](https://dependencywatch.io/package/npm/move-bcs-codec) | npm | 1.0.0 |
| [npm-dc-dev](https://dependencywatch.io/package/npm/npm-dc-dev) | npm | 1.1.1 |
| [statist-browser-typed-client-sme.rko.tariffs.web](https://dependencywatch.io/package/npm/statist-browser-typed-client-sme.rko.tariffs.web) | npm | 1.0.0 |
| [statist-statist-core](https://dependencywatch.io/package/npm/statist-statist-core) | npm | 1.0.0 |
| [streak-cache-map](https://dependencywatch.io/package/npm/streak-cache-map) | npm | 1.0.0 |
| [sui-graphql-client](https://dependencywatch.io/package/npm/sui-graphql-client) | npm | 1.0.0 |
| [sui-migration-audit-cli](https://dependencywatch.io/package/npm/sui-migration-audit-cli) | npm | 1.0.0 |
| [sui-migration-audit-rules](https://dependencywatch.io/package/npm/sui-migration-audit-rules) | npm | 1.0.0 |
| [svelte-visual-map](https://dependencywatch.io/package/npm/svelte-visual-map) | npm | 1.0.0 |
| [tailwindcss-hide-scrollbar](https://dependencywatch.io/package/npm/tailwindcss-hide-scrollbar) | npm | 1.0.0 |
| [tinkoff-boxy-desktop-two-panel-right-image](https://dependencywatch.io/package/npm/tinkoff-boxy-desktop-two-panel-right-image) | npm | 1.0.0 |
| [tinkoff-codeceptjs-storyshots-alpha](https://dependencywatch.io/package/npm/tinkoff-codeceptjs-storyshots-alpha) | npm | 1.0.0 |
| [tsihealth-client](https://dependencywatch.io/package/npm/tsihealth-client) | npm | 1.0.0 |
| [tui-react-tooltip](https://dependencywatch.io/package/npm/tui-react-tooltip) | npm | 1.0.0 |
| [typst-resume-cli](https://dependencywatch.io/package/npm/typst-resume-cli) | npm | 1.0.0 |
| [vitest-preview-pro-all](https://dependencywatch.io/package/npm/vitest-preview-pro-all) | npm | 1.0.0 |

## What happened

On 2026-08-06, the GitHub Advisory Database published **50+ new npm CWE-506 (Embedded Malicious Code) advisories** in one of the largest single-day npm sweeps in recent history. The batch decomposes into eight clusters of varying sophistication, with the Sui blockchain tooling cluster and the `@activepieces/piece-*` sweep being the most operationally-notable.

## Cluster A - Sui blockchain tooling / Move-BCS cluster (4 packages, 2026-08-06)

| Package | Notes |
|---|---|
| `sui-migration-audit-cli` | Sui migration audit CLI masquerade |
| `sui-migration-audit-rules` | Rule-pack for the audit CLI (sibling) |
| `sui-graphql-client` | Sui GraphQL client masquerade |
| `move-bcs-codec` | Move / BCS (Binary Canonical Serialization) codec masquerade |

All four use the standard CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer"). No behaviour-specific prose - but the name shapes are precise Sui-ecosystem developer targets:

- Sui migrations are the on-chain module-upgrade format; a `migration-audit-cli` would be exactly the kind of tool a Sui developer team installs during a protocol upgrade audit.
- `sui-graphql-client` matches the shape of the real Sui GraphQL indexer client - a developer building analytics on top of Sui's indexer would search for this name.
- `move-bcs-codec` matches the naming of BCS codec libraries used for on-chain Move serialization.

Combined with the same-week PyPI `alphalend-layouts` + `alphalend-abi` Sui keystore-stealer drop (see `pypi-2026-08-07-ghsa-malware-sweep`), the Sui developer ecosystem is under **coordinated cross-language attack**. Same operator running the pattern across npm + PyPI is plausible.

## Cluster B - `@activepieces/piece-*` typosquat / takeover sweep (4 packages, 2026-08-06)

| Package | Notes |
|---|---|
| `@activepieces/piece-google-contacts` | Google Contacts Zapier-alternative piece |
| `@activepieces/piece-google-bigquery` | Google BigQuery piece |
| `@activepieces/piece-google-forms` | Google Forms piece |
| `@activepieces/piece-base44` | Base44 piece |

Activepieces is a real open-source no-code / low-code Zapier alternative with a rich plugin architecture where each integration is published as `@activepieces/piece-*`. **These names match legitimate Activepieces piece names one-to-one** - so the drops are either maintainer-account takeovers (worst case) or a maintainer briefly publishing malicious builds (Shai-Hulud-style). Any Activepieces self-hoster who ran `pip install` or the equivalent auto-piece-install pipeline in the 2026-08-06 window may have pulled a malicious version.

Worth checking the specific version pinned in the legitimate Activepieces release channel against your installed version. If your Activepieces install auto-updates pieces from npm, treat the whole install as suspect until the specific version installed for each of the four names is confirmed to match the upstream-known-good version.

## Cluster C - `@ccfly/setup-*` platform-binary quartet (4 packages, 2026-08-06)

| Package | Platform |
|---|---|
| `@ccfly/setup-darwin-arm64` | Apple Silicon |
| `@ccfly/setup-darwin-x64` | Intel Mac |
| `@ccfly/setup-linux-arm64` | Linux ARM64 |
| `@ccfly/setup-linux-x64` | Linux AMD64 |

Naming mimics the **platform-binary distribution pattern** used by legitimate packages like `@esbuild/darwin-arm64`, `@rollup/linux-x64-gnu`, `@swc/core-darwin-arm64`. A legitimate package will typically publish a small stub with `optionalDependencies` on the four platform variants, and npm will pull the one matching the installer's OS/arch. The operator squatted the pattern across all four platforms to **guarantee the malicious binary fires regardless of the installer's environment**.

The missing Windows platform (`@ccfly/setup-win32-x64` / `@ccfly/setup-win32-arm64`) is notable - suggests the operator is targeting Unix-only build hosts (CI runners, Linux/Mac developer laptops) rather than Windows developers.

## Cluster D - `claude-remote-agent` full-remote Claude agent RAT (1 package, 2026-08-06)

| Package | Notes |
|---|---|
| `claude-remote-agent` | Sibling to `remote-claude-daemon` (2026-08-07 batch); Claude-Code-flavored full-remote agent |

Earlier iteration of the same threat class documented in detail under `npm-2026-08-07-ghsa-malware-sweep` Cluster A - drives Claude with permission prompts disabled from a remote C2, providing indirect but powerful arbitrary-action capability. Almost certainly the same operator; the 2026-08-07 `remote-claude-daemon` drop is a rebrand/re-publish under a new package name after the 2026-08-06 name was flagged.

## Cluster E - WhatsApp baileys sibling clones (2 packages, 2026-08-06)

| Package | Notes |
|---|---|
| `diezyyasha-baileys` | Baileys clone; WhatsApp session abuse |
| `alipclutch-baileys` | Baileys clone; WhatsApp session abuse |

Two of the five variants in the multi-day baileys-clone cluster (three more dropped 2026-08-07 as `@prototypevip/baileys`, `diezyclutch-baileys`, `ynastore-baileys`). All abuse authenticated WhatsApp Web sessions from the installer host to broadcast messages under the installer's WhatsApp identity.

## Cluster F - `@holocronlab/botruntime-runtime` bot-framework masquerade (1 package, 2026-08-06)

| Package | Notes |
|---|---|
| `@holocronlab/botruntime-runtime` | Scoped bot-runtime masquerade; likely dep-confusion against internal `holocronlab` package |

## Cluster G - `@addai/*` AI-tooling cluster (3 packages, 2026-08-06)

| Package | Notes |
|---|---|
| `@addai/ainode` | AI-node component under `addai` scope |
| `@addai/node` | Generic node package under `addai` scope |
| `@addai/entity-runtime` | Entity runtime under `addai` scope |

Multiple sibling packages published under one scope in the same batch strongly suggests an **enterprise-scope dep-confusion probe** against a target org with an internal `@addai/*` namespace.

## Cluster H - long tail (2026-08-06)

**Enterprise scopes and one-off drops** with boilerplate-only prose:

- **Tinkoff / dolyame / BNPL bank cluster** (Russian Tinkoff Bank dep-confusion continuation - see 2026-08-05 batch for the main burst): `tinkoff-codeceptjs-storyshots-alpha`, `tinkoff-boxy-desktop-two-panel-right-image`, `statist-statist-core`, `statist-browser-typed-client-sme.rko.tariffs.web`, `devplatform-vite-plugin-gle`, `devplatform-spa-plugin-error-boundary`, `devplatform-jscodeshift-utils`, `devplatform-data-table`.
- **`bigops-*` internal scope**: `bigops-tcrm-permissions`, `app-api-sdk`.
- **Ad-hoc**: `helmet-pro`, `jagproject`, `agenttunnels`, `agenthub-multiagent-mcp`, `tailwindcss-hide-scrollbar`, `@xiaohhhh1/canvas-agent`, `typst-resume-cli`, `@vanexalabs-ai/vanexa-agent`, `@atom8n/inspector`, `@apicity/meta`, `@innocarpe/deepseek-build`, `@bananacool467/ui-tools`, `@astralcore/aura-wb`, `@trackunit/iris-app-sdk-vite`, `fetchrtds`, `@aubea/mars`, `beautiful-ui-monitoring`, `@leejungkiin/awkit`, `@0l00000l/auth`, `@love-moon/conductor-cli`, `9remote`, `svelte-visual-map`, `streak-cache-map`, `tui-react-tooltip`, `vitest-preview-pro-all`, `tsihealth-client`, `npm-dc-dev`, `ezdiscordbots`, `@chnayser/server`.

All standard CWE-506 fully-compromised remediation.

## Registry state

All packages yanked / security-replaced from npm during the 2026-08-06 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- Sui cluster pairs with the PyPI `alphalend-*` keystore-stealer (see `pypi-2026-08-07-ghsa-malware-sweep`) - coordinated Sui-ecosystem attack across both languages.
- `claude-remote-agent` = sibling / earlier version of `remote-claude-daemon` (see `npm-2026-08-07-ghsa-malware-sweep` Cluster A).
- Baileys cluster began 2026-08-06 with these two variants; 3 more followed 2026-08-07.
- Tinkoff Bank dep-confusion continuation started with the massive 2026-08-05 batch (see `npm-2026-08-05-ghsa-malware-sweep`).
- No `threatActor` field set - GHSA advisories carry OpenSSF `MAL-2026-*` identifiers only.

## Impact

- **Cluster A - Sui blockchain tooling / Move-BCS cluster** (4 packages, 2026-08-06): `sui-migration-audit-cli`, `sui-migration-audit-rules`, `sui-graphql-client`, `move-bcs-codec` - all standard CWE-506 boilerplate, but the name shapes target Sui blockchain developers building on Move + BCS (Binary Canonical Serialization). Paired with the same-week PyPI `alphalend-*` Sui keystore-stealer (see `pypi-2026-08-07-ghsa-malware-sweep`), the Sui developer ecosystem is under coordinated cross-language attack this week
- **Cluster B - `@activepieces/piece-*` typosquat sweep** (4 packages, 2026-08-06): `@activepieces/piece-google-contacts`, `@activepieces/piece-google-bigquery`, `@activepieces/piece-google-forms`, `@activepieces/piece-base44`. Activepieces is a real open-source Zapier alternative with a rich `pieces` plugin architecture - the operator squatted plausible Google-integration piece names for lookalike-install exploitation. Any Activepieces self-hoster who installed a "google" or "base44" piece may have hit the malicious variants
- **Cluster C - `@ccfly/setup-*` platform-binary quartet** (4 packages, 2026-08-06): `@ccfly/setup-darwin-arm64`, `@ccfly/setup-darwin-x64`, `@ccfly/setup-linux-arm64`, `@ccfly/setup-linux-x64`. Naming mimics the platform-specific binary distribution pattern used by legitimate packages (e.g. `@esbuild/darwin-arm64`, `@rollup/linux-x64-gnu`) - the operator squatted the pattern to lookalike-install alongside a target `ccfly` package. Complete four-platform coverage ensures the malware fires regardless of the installer's OS/arch
- **Cluster D - `claude-remote-agent` full-remote Claude agent RAT** (1 package, 2026-08-06): sibling to `remote-claude-daemon` (2026-08-07 batch, see `npm-2026-08-07-ghsa-malware-sweep` Cluster A). Same threat class: driving Claude Code with permissions disabled from a remote C2. Only one version, but very likely the operator's earlier iteration before rebranding
- **Cluster E - WhatsApp baileys sibling clones** (2 packages, 2026-08-06): `diezyyasha-baileys` and `alipclutch-baileys` - two of the five variants in the multi-day baileys-clone cluster (three more dropped 2026-08-07 as `@prototypevip/baileys`, `diezyclutch-baileys`, `ynastore-baileys`). All abuse authenticated WhatsApp Web sessions
- **Cluster F - `@holocronlab/botruntime-runtime` bot-framework masquerade** (1 package, 2026-08-06): scoped-package bot-runtime tooling shape, likely dep-confusion against an internal Holocronlab bot-runtime package
- **Cluster G - `@addai/*` AI-tooling cluster** (3 packages, 2026-08-06): `@addai/ainode`, `@addai/node`, `@addai/entity-runtime`. Multiple sibling packages under one scope typical of enterprise-scope dep-confusion
- **Cluster H - long tail** (2026-08-06): `helmet-pro`, `jagproject`, `agenttunnels`, `agenthub-multiagent-mcp`, `tailwindcss-hide-scrollbar`, `@xiaohhhh1/canvas-agent`, `typst-resume-cli`, `@vanexalabs-ai/vanexa-agent`, `@atom8n/inspector`, `@apicity/meta`, `@innocarpe/deepseek-build`, `@bananacool467/ui-tools`, `@astralcore/aura-wb`, `@trackunit/iris-app-sdk-vite`, `fetchrtds`, `@aubea/mars`, `beautiful-ui-monitoring`, `@leejungkiin/awkit`, `@0l00000l/auth`, `@love-moon/conductor-cli`, `9remote`, `svelte-visual-map`, `streak-cache-map`, `devplatform-vite-plugin-gle`, `tinkoff-codeceptjs-storyshots-alpha`, `devplatform-spa-plugin-error-boundary`, `tui-react-tooltip`, `devplatform-jscodeshift-utils`, `statist-statist-core`, `tinkoff-boxy-desktop-two-panel-right-image`, `devplatform-data-table`, `vitest-preview-pro-all`, `tsihealth-client`, `npm-dc-dev`, `ezdiscordbots`, `statist-browser-typed-client-sme.rko.tariffs.web`, `app-api-sdk`, `bigops-tcrm-permissions`, `@chnayser/server`. Standard CWE-506 fully-compromised remediation applies
- All packages yanked / security-replaced from npm during the 2026-08-06 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-06 package list below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. For Sui developers: audit any `sui-*` or `move-*` npm dependency in the last 30 days. Any match on the Sui-cluster packages above should be treated together with `alphalend-*` PyPI matches (see `pypi-2026-08-07-ghsa-malware-sweep`) as one coordinated Sui ecosystem attack - move Sui assets off compromised addresses to fresh wallets on an isolated host
3. For Activepieces self-hosters: verify installed pieces against the official `activepieces/activepieces` repo `packages/pieces/` directory - the legitimate Google-integration pieces are `@activepieces/piece-google-contacts` (real), etc., so **the malicious variants use the exact same scope + package names** as legitimate pieces, meaning the compromise is a maintainer/publish takeover or account compromise rather than a plain typosquat. Check the specific published version installed matches the version pinned by the legitimate Activepieces release
4. For `claude-remote-agent` matches (critical): same remediation as `remote-claude-daemon` - the host was likely fully-remoted by the operator with Claude permissions disabled. Audit git history + shell history + cloud API calls for the last 30 days and re-image
5. For baileys-clone matches: revoke WhatsApp Web sessions from WhatsApp Settings → Linked Devices → Log Out From All Devices
6. For `@ccfly/setup-*` matches: platform-binary distribution packages usually resolve based on `optionalDependencies` + platform detection - verify which real package your build was trying to install a platform binary for; if `ccfly` is not a real dependency of your project, the resolution was a dep-confusion hit
7. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent preinstall/postinstall payloads from executing
8. Verify none of the 2026-08-06 packages still resolves via your private mirror

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-h2cr-h9m7-mxg3 - sui-migration-audit-cli malware advisory](https://github.com/advisories/GHSA-h2cr-h9m7-mxg3) - GitHub
- [GHSA-3xg5-x743-4fjc - sui-graphql-client malware advisory](https://github.com/advisories/GHSA-3xg5-x743-4fjc) - GitHub
- [GHSA-f9p8-c2qh-w7cm - sui-migration-audit-rules malware advisory](https://github.com/advisories/GHSA-f9p8-c2qh-w7cm) - GitHub
- [GHSA-3v7v-gr39-jf7v - move-bcs-codec malware advisory](https://github.com/advisories/GHSA-3v7v-gr39-jf7v) - GitHub
- [GHSA-f4vp-4vr3-ff5j - @activepieces/piece-google-contacts malware advisory](https://github.com/advisories/GHSA-f4vp-4vr3-ff5j) - GitHub
- [GHSA-9vjf-gwwg-57fp - @activepieces/piece-google-bigquery malware advisory](https://github.com/advisories/GHSA-9vjf-gwwg-57fp) - GitHub
- [GHSA-vmfr-7cqr-9wc8 - claude-remote-agent malware advisory](https://github.com/advisories/GHSA-vmfr-7cqr-9wc8) - GitHub
- [GHSA-78fc-2672-hcjg - diezyyasha-baileys malware advisory](https://github.com/advisories/GHSA-78fc-2672-hcjg) - GitHub
- [GHSA-jw7v-xrmm-426j - alipclutch-baileys malware advisory](https://github.com/advisories/GHSA-jw7v-xrmm-426j) - GitHub
- [GHSA-xj5f-xpqg-6pv6 - @ccfly/setup-darwin-arm64 malware advisory](https://github.com/advisories/GHSA-xj5f-xpqg-6pv6) - GitHub
- [GHSA-c8p8-hx32-6q2r - npm-dc-dev malware advisory (obfuscated postinstall)](https://github.com/advisories/GHSA-c8p8-hx32-6q2r) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-06-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-06-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).