# GitHub Advisory npm CWE-506 sweep - 36-package 2026-08-08 batch (`sme-rko-finance-front-*` 30-package Tinkoff/T-Bank RKO SME dep-confusion cluster running WEL1DROPPER-style cross-platform Cloudflare-Workers dropper + `@coralxyz/anchor` Solana Anchor typosquat with PowerShell zip drop + `titan-exchange-shared-permissions@99.9.9` dep-confusion recon + `@rbx-ts/services` Roblox-TS typosquat catbox.moe RAT + `map-streak-kit` Linux implant with systemd persistence + `localization-fixer`/`modern-localization` jsonbin.io mutable-payload loader pair)

> 36 npm CWE-506 advisories 2026-08-08: 30-package `sme-rko-finance-front-*` Tinkoff/T-Bank RKO dep-confusion cluster (v35.8.1, WEL1DROPPER-style Cloudflare-Workers dropper) plus outliers `@coralxyz/anchor` Solana typosquat, `titan-exchange-shared-permissions@99.9.9` recon, `@rbx-ts/services`, `map-streak-kit` Linux implant, and a `localization-fixer`+`modern-localization` jsonbin.io loader pair.

- Published: 2026-08-08
- Last updated: 2026-08-09
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 47 packages, 53 compromised versions
- Tags: dependency-confusion, credential-theft, infostealer, ci-cd-compromise, obfuscation, typosquat, dns-exfiltration
- Also known as: 2026-08-08 GHSA npm batch, sme-rko-finance-front cluster, Tinkoff RKO dep-confusion, WEL1DROPPER-family dropper
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security, amazon-inspector
- Incident ID: npm-2026-08-08-ghsa-malware-sweep

## Affected packages (47)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@coralxyz/anchor](https://dependencywatch.io/package/npm/@coralxyz/anchor) | npm | 0.30.0, 0.30.1, 0.30.2 |
| [@rbx-ts/services](https://dependencywatch.io/package/npm/@rbx-ts/services) | npm | 1.6.0 |
| [bnpl-blocks-desktop-bnpl-anchor-title](https://dependencywatch.io/package/npm/bnpl-blocks-desktop-bnpl-anchor-title) | npm | 35.2.5 |
| [localization-fixer](https://dependencywatch.io/package/npm/localization-fixer) | npm | 1.0.0, 1.0.1, 1.1.0, 1.1.1 |
| [map-streak-kit](https://dependencywatch.io/package/npm/map-streak-kit) | npm | 1.0.0 |
| [modern-localization](https://dependencywatch.io/package/npm/modern-localization) | npm | 1.1.1, 1.2.1 |
| [sme-rko-finance-front-operations-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-fee](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-fee) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-feed-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-feed-impl) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-feed-models](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-feed-models) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-holding-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-holding-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-income](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-income) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-notifications-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-notifications-impl) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-notifications-models](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-notifications-models) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-other](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-other) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-overnight](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-overnight) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-pegasus](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-pegasus) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-penalty](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-penalty) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-providers](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-providers) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-shared](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-shared) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-special-payments](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-special-payments) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-tax](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-tax) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-widget-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-widget-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-widget-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-widget-impl) | npm | 35.8.1 |
| [sme-rko-finance-front-operations-widget-models](https://dependencywatch.io/package/npm/sme-rko-finance-front-operations-widget-models) | npm | 35.8.1 |
| [sme-rko-finance-front-payment-registers-operations-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-payment-registers-operations-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-allowed-tariffs-filter](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-allowed-tariffs-filter) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-currency-payment-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-currency-payment-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-domain](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-domain) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-feed-adapter](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-feed-adapter) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-feed-display-list](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-feed-display-list) | npm | 35.8.1 |
| [sme-rko-finance-front-payments-feed-display-list-impl](https://dependencywatch.io/package/npm/sme-rko-finance-front-payments-feed-display-list-impl) | npm | 35.8.1 |
| [specials-resources-server](https://dependencywatch.io/package/npm/specials-resources-server) | npm | 35.8.1 |
| [statist-browser-typed-client-eventea.projects.pwafamily](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.pwafamily) | npm | 35.8.0 |
| [statist-browser-typed-client-eventea.projects.pwahelp](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.pwahelp) | npm | 35.8.0 |
| [statist-browser-typed-client-eventea.projects.pwainsurance](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.pwainsurance) | npm | 0.0.1 |
| [statist-browser-typed-client-eventea.projects.pwakasko](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.pwakasko) | npm | 0.0.1 |
| [statist-browser-typed-client-eventea.projects.tdeal](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.tdeal) | npm | 0.0.1 |
| [statist-browser-typed-client-eventea.projects.tdevice](https://dependencywatch.io/package/npm/statist-browser-typed-client-eventea.projects.tdevice) | npm | 0.0.1 |
| [streak-map-kit](https://dependencywatch.io/package/npm/streak-map-kit) | npm | 1.0.0 |
| [svelte-kit-cache](https://dependencywatch.io/package/npm/svelte-kit-cache) | npm | 1.0.0 |
| [svelte-streak-kit](https://dependencywatch.io/package/npm/svelte-streak-kit) | npm | 1.0.0 |
| [titan-exchange-shared-permissions](https://dependencywatch.io/package/npm/titan-exchange-shared-permissions) | npm | 99.9.9 |

## What happened

On 2026-08-08, the GitHub Advisory Database published **36 new npm CWE-506 (Embedded Malicious Code) advisories** in the largest single-day npm sweep since the 2026-05 mini-Shai-Hulud burst. The batch is dominated by the 30-package `sme-rko-finance-front-*` dep-confusion cluster targeting Tinkoff / T-Bank's internal SME banking frontend namespace, joined by six qualitatively distinct outlier drops.

## Cluster A - `sme-rko-finance-front-*` Tinkoff RKO dep-confusion / WEL1DROPPER-style cross-platform dropper (30 packages, all 35.8.1, 2026-08-08)

| Package | Version | GHSA |
|---|---|---|
| `sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models` | `35.8.1` | GHSA-xfv4-g237-3qv8 |
| `sme-rko-finance-front-payments-currency-payment-domain` | `35.8.1` | GHSA-pwjh-hjvr-rv33 |
| `sme-rko-finance-front-operations-overnight` | `35.8.1` | GHSA-c9vg-pfhf-qxw9 |
| `sme-rko-finance-front-operations-providers` | `35.8.1` | GHSA-cg6q-c6gh-62q2 |
| `sme-rko-finance-front-operations-shared` | `35.8.1` | GHSA-pp5j-rx3f-4m7x |
| `sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models` | `35.8.1` | GHSA-6hmr-8896-mrmx |
| `sme-rko-finance-front-operations-penalty` | `35.8.1` | GHSA-h56m-2x6r-3fx2 |
| `sme-rko-finance-front-operations-tax` | `35.8.1` | GHSA-p2hc-6684-r35c |
| `sme-rko-finance-front-payments-allowed-tariffs-filter` | `35.8.1` | GHSA-mp53-hghj-9r7p |
| `sme-rko-finance-front-operations-widget-models` | `35.8.1` | GHSA-gpvf-x5gg-r5cv |
| `sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-impl` | `35.8.1` | GHSA-85v5-vfj6-7hw8 |
| `sme-rko-finance-front-payments-feed-adapter` | `35.8.1` | GHSA-xprg-ffr4-2rw4 |
| `sme-rko-finance-front-operations-widget-domain` | `35.8.1` | GHSA-q26r-96fx-86h6 |
| `sme-rko-finance-front-payments-domain` | `35.8.1` | GHSA-pmc8-g84p-3x77 |
| `sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-impl` | `35.8.1` | GHSA-8q7h-xvgq-ff27 |
| `sme-rko-finance-front-operations-widget-impl` | `35.8.1` | GHSA-2phg-c6vf-892f |
| `sme-rko-finance-front-payments-feed-display-list` | `35.8.1` | GHSA-6cqr-56m6-wch6 |
| `sme-rko-finance-front-operations-special-payments` | `35.8.1` | GHSA-28cp-6vcg-8fhv |
| `sme-rko-finance-front-payment-registers-operations-domain` | `35.8.1` | GHSA-vrgq-5852-3299 |
| `sme-rko-finance-front-operations-pegasus` | `35.8.1` | GHSA-6fvh-4vgq-9765 |
| `sme-rko-finance-front-payments-feed-display-list-impl` | `35.8.1` | GHSA-4wvm-26xh-fgjw |
| `sme-rko-finance-front-operations-domain` | `35.8.1` | GHSA-4rj4-828w-hv35 |
| `sme-rko-finance-front-operations-holding-domain` | `35.8.1` | GHSA-wm7f-4h9v-m4mm |
| `sme-rko-finance-front-operations-feed-models` | `35.8.1` | GHSA-52qg-7wfr-wvgx |
| `sme-rko-finance-front-operations-other` | `35.8.1` | GHSA-xqr4-4gx9-7w24 |
| `sme-rko-finance-front-operations-fee` | `35.8.1` | GHSA-ffh6-w4x4-2j5q |
| `sme-rko-finance-front-operations-notifications-impl` | `35.8.1` | GHSA-45vf-qpf8-q2pq |
| `sme-rko-finance-front-operations-notifications-models` | `35.8.1` | GHSA-35pp-f297-w386 |
| `sme-rko-finance-front-operations-income` | `35.8.1` | GHSA-6m9x-xq34-wgvq |
| `sme-rko-finance-front-operations-feed-impl` | `35.8.1` | GHSA-j2hm-7vph-3whg |

**Target profile**: every name mimics a `sme-rko-finance-front-*` internal-scope pattern - "SME" = small/medium-enterprise, "RKO" = *расчётно-кассовое обслуживание* (settlement and cash services), the T-Bank / Tinkoff Business SME banking product line. This is a coordinated dep-confusion campaign against **Tinkoff / T-Bank's internal SME banking frontend developer team**, consistent with the pattern established in the 2026-05-29 Microsoft-disclosed `@sber-ecom-core` / Sberbank dep-confusion campaign - Russian financial-institution internal namespaces are under sustained enumeration by the same or a related operator.

**Version-jump**: every package pins to `35.8.1`, well above any plausible v1.x-v3.x internal version. Classic dep-confusion tactic to ensure the malicious public package outranks the real private version in resolvers that fall back to the public registry.

**Behaviour chain per GHSA-xfv4-g237-3qv8 and siblings**: `index.js` loads `_bridge.js` which reconstructs a set of Cloudflare Workers URLs using obfuscated string methods, downloads a platform-specific binary payload (Linux/macOS/Windows detected by `process.platform` and `process.arch`), writes the payload under `/var/tmp/<disguised-dotnet_diag-name>` (Unix) or the Windows `TEMP` directory using `dotnet_diag`-impersonating filenames and hidden dotfiles, then executes the payload via `child_process.spawn` as a detached process. A parallel dropper in `lib/telemetry.js` uses **concatenated string literals to evade detection** and base64-decodes executable chunks before spawning them under false pretenses. **DNS TXT-record fallback channels** are used for configuration delivery if the primary Cloudflare Workers hosts are blocked, and **filesystem stamps provide run-once deduplication** so the payload only drops once per host.

**Detection window**: all 30 packages were unpublished from npmjs within ~8 minutes of publication - one of the fastest npm takedown response times observed for a cluster of this size, suggesting either OpenSSF Package Analysis auto-flagged the batch immediately or a tipoff from the target org triggered a coordinated takedown. Registry timing captured `created: 2026-08-07T22:53Z` → `unpublished: 2026-08-07T23:01Z` for a representative package. The GHSA advisories were published the following calendar day (2026-08-08) after the OpenSSF sample-fetch + Amazon Inspector analysis pipeline completed.

**Relationship to WEL1DROPPER**: the technical profile - `getPlugin`-style URL construction, Cloudflare Workers dropper, cross-platform payload selection - matches the **WEL1DROPPER campaign** disclosed by Xygeni ("Malicious Code Digest 82") and covered in The Hacker News "Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer". The 800-package WEL1DROPPER wave targets a broader `require()`-based README-instruction distribution vector; the `sme-rko-finance-front-*` cluster uses the same dropper technology but ships as a straight postinstall dep-confusion drop against a specific target org.

## Cluster B - `@coralxyz/anchor` Solana Anchor typosquat with Windows PowerShell zip drop (1 package, 2026-08-08)

| Package | Versions | Notes |
|---|---|---|
| `@coralxyz/anchor` | `<= 0.30.2` | Typosquats `@coral-xyz/anchor` (hyphen removed), Windows postinstall zip-drop-then-execute |

Drops the hyphen from Solana's real `@coral-xyz/anchor` on-chain smart-contract dev framework. Postinstall runs obfuscated code; on Windows only, downloads a zip from an anonymous file host, extracts via PowerShell, and detach-executes any `.exe` found. Ships **no genuine Anchor functionality** - existing solely as a delivery vector. OpenSSF `MAL-2026-13629`; discovery credited to `amazon-inspector`.

## Cluster C - `titan-exchange-shared-permissions@99.9.9` dep-confusion recon (1 package, 2026-08-08)

| Package | Version | Notes |
|---|---|---|
| `titan-exchange-shared-permissions` | `99.9.9` | Version-jump dep-confusion, postinstall webhook recon |

**Version `99.9.9`** is the giveaway - designed to outrank any plausible-real internal version of a `titan-exchange` internal package. Postinstall collects username + hostname + cwd + IPv4 address and HTTPS-POSTs to a hardcoded webhook. Naming targets a `titan-exchange` internal scope, consistent with the crypto-exchange target profile. Advisory ships only recon; a stage-2 payload is likely to follow if the operator confirms the recon output identifies a live target org. OpenSSF `MAL-2026-13664`.

## Cluster D - `@rbx-ts/services` Roblox TS typosquat with catbox.moe zip drop (1 package, 2026-08-08)

| Package | Versions | Notes |
|---|---|---|
| `@rbx-ts/services` | `>= 1.6.0` | Marketed as Roblox TypeScript definitions, Windows-only catbox.moe zip drop |

Windows-only (`process.platform === "win32"` gate) postinstall. Uses hex-escaped identifiers and base64-encoded strings to hide `https`, `fs`, `child_process`, `powershell`, and `.exe` references. Decodes and fetches `files.catbox.moe/9bppy2.zip`, extracts via PowerShell, detach-executes the first `.exe`, then deletes evidence. Marketed as Roblox TypeScript type definitions (a plausibly-real name in the Roblox-TS ecosystem) with no legitimate reason for a bundled executable. OpenSSF `MAL-2026-13630`.

## Cluster E - `map-streak-kit` Linux implant with systemd persistence + SSH-key theft (1 package, 2026-08-08)

| Package | Versions | Notes |
|---|---|---|
| `map-streak-kit` | `1.0.0` | Linux binary implant, C2 `217.60.77.63`, systemd persistence, SSH-key/env exfil |

Drops a disguised Linux binary claiming to be a "native math accelerator". Actual behaviour: **beacons to C2 `217.60.77.63`, executes shell commands from C2, installs a systemd unit for boot persistence, and harvests SSH keys + stored credentials + environment variables** for exfiltration. **Most severe non-cluster-A drop of the batch** - a working Linux RAT with persistence and credential theft, one npm-install away. OpenSSF `MAL-2026-13632`.

## Cluster F - `localization-fixer` + `modern-localization` mutable-jsonbin.io payload loader pair (2 packages, 2026-08-08)

| Package | Versions | Notes |
|---|---|---|
| `localization-fixer` | `<= 1.0.1`, `<= 1.1.1` | JSONbin.io mutable payload, `child_process.fork` + `new Function()` execution |
| `modern-localization` | `1.1.1`, `1.2.1` | JSONbin.io mutable payload, same execution shape |

Both fetch JavaScript payloads from **attacker-controlled JSONbin.io endpoints** on `require()` and execute via `child_process.fork` (writing to temp file and forking) plus `new Function()` constructor with Node's `require` in scope. Both use innocuous function names (`syncLanguageSystem`, `LANG_SOURCE`) to disguise as legitimate localization utilities.

**The critical detail**: because JSONbin.io bins are mutable and controlled by the operator, **the payload can rotate silently at any moment** without republishing to npm. Whatever the payload was during your install may bear no relationship to what a security researcher sees today. Treat both packages as full-capability RATs regardless of what the JSONbin.io endpoint currently serves. OpenSSF `MAL-2026-13631` and `MAL-2026-13633`.

**Distinction from lifecycle-hook malware**: these packages run on `require()`, not `preinstall`/`postinstall`. **`npm ci --ignore-scripts` does NOT mitigate them** - the payload fires the first time the module is imported. Same execution vector as the Xygeni-flagged WEL1DROPPER wave.

## Registry state

All 36 packages yanked / security-replaced from npm during the 2026-08-08 takedown. Registry timing suggests the takedown was extremely fast (~8 minutes for the sme-rko-finance cluster). Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

## Related tracked activity

- **WEL1DROPPER umbrella campaign**: Xygeni ("Malicious Code Digest 82") and The Hacker News (2026-08 "Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer") describe an 800-package WEL1DROPPER RAT + infostealer wave using cross-platform Cloudflare Workers droppers and the `getPlugin` `require()`-triggered execution model. The 30-package `sme-rko-finance-front-*` cluster catalogued here uses the same dropper technology but ships as a target-specific dep-confusion drop rather than as opportunistic README-instructed `require()`-load bait. The `localization-fixer` + `modern-localization` pair matches the `require()`-triggered WEL1DROPPER model more directly.
- **Russian financial-institution dep-confusion sequence**: 2026-05-29 Microsoft Security Blog disclosed the `@sber-ecom-core` Sberbank-targeted dep-confusion campaign (33 packages). Today's `sme-rko-finance-front-*` cluster is the same TTP applied to Tinkoff / T-Bank's SME (RKO) banking frontend namespace. Coordinated targeting of Russian financial developer teams via dep-confusion is now a recurring pattern - watch for further `@sber-*`, `@tinkoff-*`, `@vtb-*`, `@raiff-*`, `@alfa-*` internal-scope clusters in the coming daily batches.
- **Solana ecosystem typosquat pressure**: `@coralxyz/anchor` (this batch) joins prior `@sui-migration-audit-*`, `@move-*` (npm 2026-08-06), `alphalend-*` (PyPI 2026-08-07) as the third consecutive-day cross-language attack on the Solana/Sui developer ecosystem.
- Discovery credits: `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `npm Security`, `amazon-inspector`. No named threat actor - MAL-2026-*(13486..13664) identifiers only.

## Impact

- **Cluster A - `sme-rko-finance-front-*` Tinkoff RKO dep-confusion / WEL1DROPPER cross-platform dropper** (30 packages, all `35.8.1`, 2026-08-08): every package name mimics the T-Bank / Tinkoff internal SME banking (RKO) frontend package namespace (e.g. `sme-rko-finance-front-payments-domain`, `sme-rko-finance-front-operations-widget-impl`, `sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models`). On install, `_bridge.js` selects a platform-specific asset path, **downloads bytes from a rotating set of Cloudflare Workers endpoints**, writes the payload under `/var/tmp` (Unix) or `%TEMP%` (Windows) using **disguised names impersonating `dotnet_diag` and hidden dotfiles**, and executes it with detached process spawn. A parallel dropper in `lib/telemetry.js` handles redundancy and uses **DNS TXT-record fallback channels** for C2 configuration if the Workers endpoints are blocked. **Runtime string reconstruction, run-once deduplication via filesystem stamps, and base64 chunk decoding evade static analysis**. Any T-Bank / Tinkoff SME dev whose CI resolved any of the 30 packages must treat the CI runner as fully compromised at the native-code level. All 30 versions were unpublished from npmjs within ~8 minutes of publication - private mirrors that cached tarballs in that window are the only remaining exposure route
- **Cluster B - `@coralxyz/anchor` Solana Anchor framework typosquat** (1 package, `<= 0.30.2`, 2026-08-08): removes the hyphen from the real `@coral-xyz/anchor` framework (Solana on-chain smart-contract dev framework). Postinstall runs obfuscated code that on Windows downloads a zip from an anonymous file host, extracts it via PowerShell, and executes any `.exe` inside as a detached process. The package ships **no genuine Anchor functionality** - it exists only as a Windows-only Solana-developer-targeted RAT delivery mechanism
- **Cluster C - `titan-exchange-shared-permissions@99.9.9` dep-confusion reconnaissance** (1 package, `99.9.9`, 2026-08-08): version-jump to `99.9.9` outranks any plausible real internal package version. Postinstall harvests username + hostname + cwd + IPv4 address and HTTPS-POSTs to a hardcoded webhook. Naming targets a `titan-exchange` internal scope - likely a crypto-exchange internal package namespace under active reconnaissance. Advisory carries only recon behaviour; a stage-2 payload matching the recon results is likely to follow if the operator confirms a live target org
- **Cluster D - `@rbx-ts/services` Roblox TypeScript definitions typosquat** (1 package, `>= 1.6.0`, 2026-08-08): masquerades as Roblox TypeScript type definitions (a plausible-real name in the Roblox-TS ecosystem). Windows-only postinstall (`process.platform === "win32"` gate) decodes a hex-escaped + base64-encoded fetch URL, downloads a zip from `files.catbox.moe/9bppy2.zip`, extracts via PowerShell, and detach-executes the first `.exe` before deleting evidence. Anonymous file host means the payload can rotate silently
- **Cluster E - `map-streak-kit` Linux implant with systemd persistence** (1 package, `1.0.0`, 2026-08-08): on import, drops a Linux binary disguised as a "native math accelerator", beacons to hardcoded C2 `217.60.77.63`, executes shell commands from C2, installs a **systemd unit for boot persistence**, and harvests **SSH keys + stored credentials + environment variables** for exfiltration. Any Linux CI runner or dev workstation that imported this package must be treated as fully compromised - re-image the host and rotate every SSH key + credential + env-var secret
- **Cluster F - `localization-fixer` + `modern-localization` mutable-jsonbin.io payload-loader pair** (2 packages, 2026-08-08): both fetch JavaScript payloads from **attacker-controlled JSONbin.io endpoints** on package initialisation and execute via `child_process.fork` + `new Function()` with Node's `require` capability. Because the JSONbin bins are mutable, **the payload can change at any time between installs** - the operator can silently update the RAT/stealer without republishing to npm. Marketed as innocuous "localization" helpers with function names like `syncLanguageSystem` and `LANG_SOURCE`

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-08 package list below - especially the 30 `sme-rko-finance-front-*` names (any T-Bank / Tinkoff CI hit is a native-code compromise), `@coralxyz/anchor`, `titan-exchange-shared-permissions`, `@rbx-ts/services`, `map-streak-kit`, `localization-fixer`, `modern-localization`
2. **For any `sme-rko-finance-front-*` match (critical)**: treat the affected host as fully compromised at the native-code level. Native binary was written to `/var/tmp/<disguised-dotnet_diag-name>` on Unix or `%TEMP%\<disguised-dotnet_diag-name>` on Windows, may have installed persistence, and connected to Cloudflare Workers C2 with DNS TXT fallback. Kill any process matching the `dotnet_diag*` or hidden-dotfile pattern in those directories, block outbound to `*.workers.dev` at the network egress, re-image the affected host, and rotate every credential (npm tokens, cloud, VCS, CI) that lived on it. If you are inside T-Bank / Tinkoff SME infrastructure, escalate to internal security immediately: this is a live active dep-confusion attempt against your internal RKO namespace
3. For `@coralxyz/anchor` matches: uninstall, block the package name in `.npmrc`. On Windows, hunt for the PowerShell-extracted staged .exe under `%TEMP%` from within the exposure window and any executable spawned as a detached process during install. Correct the typo to the real `@coral-xyz/anchor` (with hyphen)
4. For `titan-exchange-shared-permissions@99.9.9` matches: your username + hostname + cwd + IP have already been sent to the operator. Treat as dep-confusion scope disclosure; configure `.npmrc` scope-to-registry mapping so `titan-exchange-*` internal names resolve only from your private mirror. Watch for a stage-2 malicious drop under the same name in the next daily GHSA batches
5. For `@rbx-ts/services` matches: any host with a stored Roblox studio session, Roblox account cookie, or crypto wallet accessible to the Windows user must be considered compromised. Rotate Roblox credentials, revoke Roblox API keys, and hunt for the `catbox.moe`-fetched .exe under `%TEMP%`
6. For `map-streak-kit` matches: **most severe non-cluster-A remediation**. Re-image the affected Linux host from bare metal, rotate every SSH key on the host (including any private key with the same fingerprint reused elsewhere), rotate every credential stored in env or config files, and remove any systemd unit created in the exposure window. C2 `217.60.77.63` should be blocked at the network egress and its network flows tracked
7. For `localization-fixer` / `modern-localization` matches: **the historical payload does not fully characterise the risk** - the JSONbin.io payload is mutable and could have been anything at the moment your install ran. Treat both packages as fully-compromised RATs regardless of what the JSONbin.io endpoint returns today. Block outbound to `api.jsonbin.io` from any host that installed either package during the exposure window and audit process creation / network flow logs for whatever the payload actually did during install
8. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent preinstall/postinstall payloads from executing (mitigates Clusters A-E; does NOT mitigate F, which runs on `require` rather than lifecycle hook)
9. Verify none of the 2026-08-08 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xfv4-g237-3qv8 - sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (Tinkoff RKO dep-confusion / WEL1DROPPER dropper)](https://github.com/advisories/GHSA-xfv4-g237-3qv8) - GitHub
- [GHSA-pwjh-hjvr-rv33 - sme-rko-finance-front-payments-currency-payment-domain (Cloudflare Workers dropper + DNS TXT fallback)](https://github.com/advisories/GHSA-pwjh-hjvr-rv33) - GitHub
- [GHSA-c9vg-pfhf-qxw9 - sme-rko-finance-front-operations-overnight](https://github.com/advisories/GHSA-c9vg-pfhf-qxw9) - GitHub
- [GHSA-p2hc-6684-r35c - sme-rko-finance-front-operations-tax](https://github.com/advisories/GHSA-p2hc-6684-r35c) - GitHub
- [GHSA-hhj6-h3rr-qc2j - @coralxyz/anchor Solana Anchor typosquat malware advisory (Windows PowerShell zip drop)](https://github.com/advisories/GHSA-hhj6-h3rr-qc2j) - GitHub
- [GHSA-8qhv-45mq-rp4v - titan-exchange-shared-permissions dep-confusion recon malware advisory (99.9.9 version-jump)](https://github.com/advisories/GHSA-8qhv-45mq-rp4v) - GitHub
- [GHSA-2846-4m8r-rvv5 - @rbx-ts/services Roblox-TS typosquat malware advisory (catbox.moe zip drop)](https://github.com/advisories/GHSA-2846-4m8r-rvv5) - GitHub
- [GHSA-2fcq-4c2w-gvm3 - map-streak-kit Linux implant malware advisory (systemd persistence, SSH-key theft, C2 217.60.77.63)](https://github.com/advisories/GHSA-2fcq-4c2w-gvm3) - GitHub
- [GHSA-744p-7qm5-8wpj - localization-fixer JSONbin.io mutable-payload malware advisory](https://github.com/advisories/GHSA-744p-7qm5-8wpj) - GitHub
- [GHSA-qf2g-q6rj-77q5 - modern-localization JSONbin.io mutable-payload malware advisory](https://github.com/advisories/GHSA-qf2g-q6rj-77q5) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [Malicious npm packages abuse dependency confusion to profile developer environments (May 2026 Sberbank campaign, same TTP)](https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/) - Microsoft Security

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).