GitHub Advisory npm CWE-506 sweep - 2026-08-10 batch (`iconova-react` + `postcss-initial-provider` on-chain Ethereum RPC dead-drop C2 loader pair, `svelte-kit-streak`+`kit-map-streak` Linux implant continuation of the map-streak-kit family, `@rblxts/services` catbox.moe Windows RAT sibling of last week's `@rbx-ts/services`, `@kuperka/chainguard-sdk` browser-form + wallet exfil, `xerohub-discord-voice` Discord-token stealer, `env-local` Windows persistent screen-capture + remote control, `hex-encode-utils` Cloudflare-Workers AES-GCM Python-payload loader, `cryptostock`/`tokocrytodev` Infura wallet-drainer, `simple-date-formatter-new-9/10` bash reverse shell to 124.221.154.135:4444, `polymarket-stake-mathss` log-taker.store loader, `chai-tracker` chai-spies impersonator with `dbconnectify` C2, `@noobaihome/amis-*-area-widget` Baidu-internal dep-confusion SSRF probe, and multi-vendor SQLite/postcss/commonjs/eth-library typosquat clusters)

What happened

On 2026-08-10, the GitHub Advisory Database published 46 new npm CWE-506 (Embedded Malicious Code) advisories. Unlike the 2026-08-08 batch (which was dominated by a single 30-package Tinkoff RKO dep-confusion cluster), the 2026-08-10 batch is a broad multi-cluster sweep: a small handful of high-impact drops with fully-characterised behaviour plus a long tail of vendor-namespace typosquats carrying only the CWE-506 boilerplate.

Cluster A - On-chain Ethereum RPC dead-drop C2 loader pair (EtherHiding-family)

| Package | Versions | GHSA | Notes | |---|---|---|---| | iconova-react | 1.30.0, 1.30.1 | GHSA-9hjr-qcfj-h3wj (+ GHSA-mvp5-cv38-rqfj boilerplate) | Malicious loader injected into two icon modules; queries Ethereum RPC for stage-2 IPv4; eval()s downloaded payload as detached Node process; unicode-escaped identifiers hide ethers/fetch/eval; impersonates lucide-react | | postcss-initial-provider | <=3.0.4 | GHSA-9qww-697m-3rg3 (+ GHSA-44hx-h55m-c65w boilerplate) | Obfuscated code queries Ethereum RPC for transaction data from hardcoded wallet, extracts IP from tx data, fetches + executes encrypted payload |

Both packages use the on-chain dead-drop C2 pattern - the operator publishes stage-2 infrastructure addresses (IPv4s, in this batch) into transaction calldata on an attacker-controlled Ethereum wallet, and the malicious loader retrieves the addresses at require() time by making a plain eth_getTransactionByHash / getTransactions call against a public Ethereum RPC. Same technique class as the CHAINDROP naming applied by StepSecurity, Elastic Security Labs, and Unit 42 to the 2026-08-04 keyv/cacheable Shai-Hulud worm, where the smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 served the C2 domain rather than IPv4 addresses.

Why this matters as an IOC problem: no static C2 domain / IP is embedded in the package. The operator can rotate C2 infrastructure by publishing a new transaction from the attacker wallet - the poisoned package fetches the new address automatically the next time it loads. Blocklists built off traditional IOCs will not catch the stage-2 hosts on subsequent installs. The only durable mitigation is to block outbound to Ethereum public RPCs from build/dev hosts that have no legitimate need to reach them, and to correlate any outbound HTTP GET during install with the immediately-preceding Ethereum RPC call in the same process tree.

Cluster B - map-streak-kit Linux-implant family continuation (2 packages, 2026-08-10)

| Package | Versions | GHSA | |---|---|---| | svelte-kit-streak | >=0 (1.0.0) | GHSA-rc4p-g2mc-7w8h | | kit-map-streak | >=0 (1.0.0) | GHSA-7wwj-2mjc-pmxq |

Both carry only the boilerplate CWE-506 text on the GHSA advisory pages, but the naming pattern (*-streak-*, svelte-kit-*) and the batch timing places them squarely inside the map-streak-kit / streak-map-kit / svelte-streak-kit / svelte-kit-cache cluster catalogued in the 2026-08-08 GHSA batch. That cluster shipped a Linux binary implant with systemd persistence, C2 beacon to 217.60.77.63, and SSH-key + credential exfil - treat these two as sibling drops of the same implant family until Socket or OpenSSF post a differentiated sample.

Cluster C - @rblxts/services Roblox-TS Windows RAT (1 package, 2026-08-10)

| Package | Versions | GHSA | |---|---|---| | @rblxts/services | 1.6.0, 1.6.2 | GHSA-x6xv-2jr9-4pc5 |

Sibling of the 2026-08-08 @rbx-ts/services drop - the operator swapped rbx-ts for rblxts and republished the same Windows-only postinstall RAT: hex-encoded fs/https/child_process/powershell/.exe API references, base64-encoded fetch URL, downloads a zip from an anonymous file host on Windows only, extracts via PowerShell, detach-executes any .exe.

Cluster D - @kuperka/chainguard-sdk browser data-exfil + wallet + keylogger (1 package, 2026-08-10)

| Package | Versions | GHSA | OpenSSF | |---|---|---|---| | @kuperka/chainguard-sdk | 1.0.1, 1.0.2 | GHSA-x3c3-qwj8-qfpc | MAL-2026-13688 |

Masquerades as a Chainguard/Web3-security SDK. When loaded in a browser context, harvests every form value, every credential regex match, EVM + Solana wallet addresses (via window.ethereum / window.solana), every keystroke in input/textarea/select, and monkey-patches window.fetch to capture URLs + methods + bodies + Authorization headers. All data is base64-encoded and POSTed to a webhook.

Cluster E - xerohub-discord-voice Discord-token stealer (1 package, 2026-08-10)

| Package | Versions | GHSA | |---|---|---| | xerohub-discord-voice | 1.0.0, 1.0.1 | GHSA-mppv-3p7f-3fmq |

Advertises a startVoiceJoiner(config) helper; hidden sendTokenToCreator() POSTs the Discord token + voice server ID + channel ID + username to an external webhook via axios. Thai-language code comments confirm the exfil is intentional; current webhook is a placeholder string but the stealing mechanism is fully wired.

Cluster F - env-local Windows persistent screen-capture + remote-control implant (1 package, 2026-08-10)

| Package | Versions | GHSA | |---|---|---| | env-local | <=18.4.2 | GHSA-r3pr-mmg7-gr2j |

Highest-severity single package of the batch. Masquerades as dotenv. lib/tui-options.js unconditionally captures the installer's screen every 3 seconds and transmits to a remote server; polls for mouse + keyboard commands and replays them locally via @nut-tree-fork/nut-js for interactive remote-desktop control; on Windows writes a VBS launcher under %APPDATA%\ScreenCaptureClient and adds an HKCU\...\Run\ScreenCaptureClient registry entry for boot persistence. Any developer workstation that pulled env-local gets a live persistent RAT.

Cluster G - hex-encode-utils Cloudflare-Workers AES-GCM Python-payload loader (1 package, 2026-08-10)

| Package | Versions | GHSA | |---|---|---| | hex-encode-utils | 1.0.0-1.0.5 | GHSA-2p54-jrq3-p4p9 |

Postinstall fetches an AES-256-GCM-encrypted blob over HTTPS from two hardcoded Cloudflare Workers hosts with TLS verification disabled, decrypts with a hardcoded key, writes to ~/.cache/hex-encode-utils/modules/exec_runtime.py, detach-executes via a Python process. Beacons hostname + username + platform + Node version + package version to a Telegram relay. Explicit sandbox evasion - only fires on developer workstations, not CI/containers.

Cluster H - Infura wallet-drainer + C2 loop (2 packages, 2026-08-10)

| Package | Versions | GHSA | Attacker address | |---|---|---|---| | cryptostock | 1.0.0, 1.0.1 | GHSA-vxm9-fcc8-7337 | (not disclosed) | | tokocrytodev | 1.0.0 | GHSA-m482-gfg4-jcp7 | 0x742d35Cc6634C0532925a3b844Bc454e4438f44e |

Both connect to attacker C2, poll for shell commands, return AES-256-ECB-encrypted output, then after a 2-8 minute delay search ~/.ssh, /root/.ssh, ~/.ethereum/keystore for private keys and drain any 64-hex private key or ETH_PRIVATE_KEY env var to a hardcoded attacker address via mainnet.infura.io. cryptostock C2: badai.run.place / /cekappapiapi.php. Base64 string tables obfuscate the C2 host and keystore paths.

Cluster I - simple-date-formatter-new-9 / -new-10 bash reverse shell (2 packages, 2026-08-10)

| Package | Versions | GHSA | C2 | |---|---|---|---| | simple-date-formatter-new-9 | 1.0.0 | GHSA-fq7m-frv3-2w4v | 124.221.154.135:4444 | | simple-date-formatter-new-10 | 1.0.0 | GHSA-wgv9-74pq-hwh9 | 124.221.154.135:4444 |

package.json postinstall opens an interactive bash reverse shell to 124.221.154.135:4444; postinstall.js enumerates ~/.ssh and POSTs the file listing + username + platform to the same C2.

Cluster J - polymarket-stake-mathss Polymarket typosquat with log-taker.store loader (1 package, 2026-08-10)

| Package | Versions | GHSA | C2 | |---|---|---|---| | polymarket-stake-mathss | <=3.5.2 | GHSA-2qqg-9fjr-5mw9 | log-taker.store |

Postinstall reads a bundle URL from the homepage field, fetches a tarball from https://log-taker.store/config/stake-math-sync.json, extracts, runs npm install inside, loads + invokes malicious modules. Function names resolvePeerBundleUrl and PSM_INSTALL_FAST disguise the tarball-fetch loader as a build step. Sibling to the 2026-07-17 polymarket-trap @polymarket/clob-client typosquat and 2026-06-27 polymarket-clob-math - Polymarket/prediction-market SDK typosquats are now a persistent monthly cadence.

Cluster K - chai-tracker chai.use()-triggered detached-process C2 loader (chai-spies impersonator) (1 package, 2026-08-10)

| Package | Versions | GHSA | C2 dependency | |---|---|---|---| | chai-tracker | 1.1.0-1.1.3, 1.2.1 | GHSA-j2r4-fv2p-jjf8 | dbconnectify |

When loaded via chai.use(), spawns a detached child process that executes arbitrary code from an attacker-controlled dbconnectify dependency with suppressed output. Function definition hides inside legitimate-looking assertion methods.

Cluster L - @noobaihome/amis-* Baidu-internal dep-confusion SSRF probe (2 packages, 2026-08-10)

| Package | Versions | GHSA | Notes | |---|---|---|---| | @noobaihome/amis-simple-area-widget | 1.0.0 | GHSA-jprv-2653-h4xc | Preinstall SSRF to bsrc-ssrf.n.baidu-int.com, exfil to 49.232.169.67:43817 | | @noobaihome/amis-uni-area-widget | 1.0.0 | GHSA-932g-6p3v-rp3w | Sibling drop, same TTP |

Advisory explicitly states "the package name is a dependency-confusion lure against an internal @noobaihome scope". Both packages ship empty dist/renderer.umd.js and dist/plugin.umd.js stubs; the functional code lives entirely in the preinstall script.

Cluster M - Multi-vendor typosquat cluster (long tail, boilerplate CWE-506 only)

SQLite / better-sqlite typosquat cluster (6 packages): @sqlite-labs/createsql, @sqlite-labs/nodesql, @sqlite-table/sql-creator, @sqlite-table/schema-generator, @sqlite-prime/nodesql, @sqlite-prime/createsql. Three scopes, three sibling packages each - coordinated multi-scope typosquat drop.

postcss typosquat cluster (3 packages): postcss-initial-provider (also Cluster A), post-css-transfer (hyphen change), postcss-theme-provider.

commonjs typosquat cluster (2 packages): commonjs-assert (impersonating the standard commonjs-assert namespace), commonjs-assertion.

Ethereum library typosquat cluster (2 packages): eth-library-toolkit, eth-library-utils.

chai-ecosystem typosquat cluster (6 packages beyond chai-tracker in Cluster K): chai-as-promised-plus, chai-as-map, chai-as-format, chai-as-deployer, chai-as-bench, chai-jsonss.

Standalone drops: spoint (0.1.695-0.1.700), godot-kit (<=1.0.1786316795), tailwind-elements-ui, runtimekit, fsbrowse (<=0.2.28), neverthrow-js, @ssgw/icon@9.999.999, hex-encode-utils (also Cluster G).

Registry state

All 46 packages yanked or security-replaced from npm during the 2026-08-10 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before takedown will keep serving the malicious versions.

Related tracked activity

• CHAINDROP / on-chain C2 register: Cluster A packages (iconova-react, postcss-initial-provider) use the same EtherHiding technique class as the CHAINDROP keyv/cacheable worm catalogued a week earlier. The CHAINDROP naming was applied by StepSecurity, Elastic Security Labs, and Palo Alto Unit 42 to the keyv/cacheable payload; the Cluster A pair is likely the operator (or a copycat) porting the technique to smaller-scale drops.
• map-streak-kit implant family: svelte-kit-streak + kit-map-streak (Cluster B) continue the family established on 2026-08-08.
• Roblox-TS typosquat register: @rblxts/services (Cluster C) continues the register established with @rbx-ts/services on 2026-08-08.
• Polymarket / prediction-market SDK typosquat register: polymarket-stake-mathss (Cluster J) is the third distinct Polymarket typosquat drop in ~six weeks - see also 2026-07-17 polymarket-trap and 2026-06-27 polymarket-clob-math-vercel-loader.
• Discovery credits: OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security, amazon-inspector, Aikido. No named threat actor.

Affected packages (42)

Impact

• Cluster A - on-chain Ethereum RPC dead-drop C2 loader pair (EtherHiding-family): iconova-react@1.30.0/1.30.1 and postcss-initial-provider@<=3.0.4 load a malicious loader at require() time that queries an Ethereum RPC to read transaction data from a hardcoded attacker wallet, extracts an IPv4 stage-2 host from the on-chain payload, and downloads + eval()s the resulting code as a detached Node process. Iconova-react uses unicode-escaped identifiers to hide ethers, fetch, eval from static scanners; both packages impersonate legitimate targets (lucide-react for iconova-react; the real postcss-initial for postcss-initial-provider). Same EtherHiding smart-contract-as-C2-registry pattern as the CHAINDROP keyv/cacheable worm. Note two GHSA advisories exist for iconova-react (GHSA-mvp5-cv38-rqfj boilerplate + GHSA-9hjr-qcfj-h3wj detailed) - both refer to the same package
• Cluster B - map-streak-kit Linux-implant family continuation (svelte-kit-streak, kit-map-streak): sibling drops of the map-streak-kit / streak-map-kit / svelte-streak-kit / svelte-kit-cache cluster catalogued in the 2026-08-08 GHSA batch. Same TTP family - Linux binary drop, C2 beacon, systemd persistence, SSH-key + credential exfil. Any Linux CI runner or workstation that installed either package during the exposure window must be treated as fully compromised at the native-code level: re-image and rotate every SSH key + credential + env-var secret
• Cluster C - @rblxts/services Roblox-TS Windows RAT (sibling of @rbx-ts/services from 2026-08-08): continues the Roblox-TS typosquat family. scripts/postinstall.js hex-encodes fs/https/child_process/powershell/.exe API names, base64-encodes the fetch URL, downloads a zip from an anonymous file host on Windows, extracts via PowerShell, and detach-executes any .exe without integrity verification. Same TTP as the earlier @rbx-ts/services drop - the operator is iterating on typosquat names against the same target ecosystem. Any Windows host with a stored Roblox studio session, Roblox account cookie, or crypto wallet accessible to the Windows user must be considered compromised
• Cluster D - @kuperka/chainguard-sdk browser data-exfil + wallet + keylogger (Chainguard impersonator): masquerades as a Chainguard/Web3-security SDK. Harvests document.cookie, localStorage, sessionStorage, every input value, and regex-matched credentials; captures EVM + Solana wallet addresses via window.ethereum and window.solana; keystroke-logs every input/textarea/select; monkey-patches window.fetch to capture outbound URLs, methods, request bodies, and Authorization headers. All data is base64-encoded and POSTed to a webhook collector. Marketed under a plausible-looking @kuperka scope
• Cluster E - xerohub-discord-voice Discord-token stealer: advertises a startVoiceJoiner(config) API for Discord voice channels. Hidden sendTokenToCreator() function silently POSTs the Discord token, voice server IDs, channel IDs, and username to an external webhook via axios. Thai-language code comments confirm the exfil is intentional. Current webhook is a placeholder string, but the stealing function is fully wired: any bot deployment that supplied real credentials would have exfiltrated them
• Cluster F - env-local Windows persistent screen-capture + remote-control implant (dotenv impersonator): masquerades as dotenv. Unconditionally captures the installer's screen every 3 seconds and transmits it + system details to a remote server; polls an external endpoint for mouse/keyboard commands and replays them locally via @nut-tree-fork/nut-js for interactive remote control; on Windows writes a VBS launcher under %APPDATA%\ScreenCaptureClient and an HKCU registry entry named ScreenCaptureClient for boot-persistence auto-execution. Very high blast radius - any developer workstation that pulled env-local gets a live persistent remote-desktop RAT
• Cluster G - hex-encode-utils Cloudflare-Workers AES-GCM Python-payload loader with sandbox evasion: postinstall fetches an AES-256-GCM-encrypted blob over HTTPS from two hardcoded Cloudflare Workers hosts with TLS verification disabled, decrypts with a hardcoded key, writes to ~/.cache/hex-encode-utils/modules/exec_runtime.py, and detach-executes via a Python process. Before executing, POSTs a beacon with hostname + username + platform + Node version + package version to a Telegram relay. Only fires on developer workstations - avoids CI/container environments (explicit sandbox evasion)
• Cluster H - cryptostock / tokocrytodev Infura wallet-drainer + C2 loop: both packages connect to attacker C2 (badai.run.place for cryptostock), poll for shell commands via /cekappapiapi.php, and return AES-256-ECB-encrypted results. After a 2-8 minute delay, both search ~/.ssh, /root/.ssh, ~/.ethereum/keystore for private keys and certificates, and for each 64-hex private key found (plus the ETH_PRIVATE_KEY env var) build a web3 wallet against mainnet.infura.io and transfer the full balance minus gas to hardcoded attacker addresses (tokocrytodev uses 0x742d35Cc6634C0532925a3b844Bc454e4438f44e). Both use base64 string tables to obfuscate C2 host + keystore paths
• Cluster I - simple-date-formatter-new-9 / -new-10 bash reverse shell + SSH-key enumeration: package.json postinstall opens an interactive bash reverse shell to hardcoded 124.221.154.135:4444; postinstall.js enumerates ~/.ssh and POSTs the file listing + username + platform to the same server. Both mechanisms fire automatically on npm install
• Cluster J - polymarket-stake-mathss Polymarket typosquat with log-taker.store loader: typosquats polymarket-stake-math. Postinstall reads the homepage field from package.json, fetches a tarball URL from https://log-taker.store/config/stake-math-sync.json, extracts, runs npm install inside the extract, and loads + invokes the malicious modules. Function names like resolvePeerBundleUrl and PSM_INSTALL_FAST disguise the tarball-fetch loader as a legitimate build step
• Cluster K - chai-tracker chai.use()-triggered detached-process C2 loader (chai-spies impersonator): impersonates chai-spies. When loaded via chai.use(), spawns a detached child process that executes arbitrary code from the attacker-controlled dbconnectify dependency with suppressed output. Function definition hides inside legitimate-looking assertion methods. Also part of a broader chai-ecosystem typosquat wave in the same batch (chai-as-promised-plus, chai-as-map, chai-as-format, chai-as-deployer, chai-as-bench, chai-jsonss) - only chai-tracker has fully-analysed behaviour on the batch date; the others carry only the CWE-506 boilerplate but should be treated as sibling drops until proven otherwise
• *Cluster L - `@noobaihome/amis- Baidu-internal dep-confusion SSRF probe**: @noobaihome/amis-simple-area-widget and @noobaihome/amis-uni-area-widget are **dep-confusion lures against the internal @noobaihome scope**. Preinstall script fetches from bsrc-ssrf.n.baidu-int.com and base64-exfiltrates the response to 49.232.169.67:43817. Blind SSRF + dep-confusion probe using the installer's network access to enumerate internal Baidu network topology. dist/renderer.umd.js and dist/plugin.umd.js` are empty stubs
• Cluster M - multi-vendor typosquat clusters (SQLite, postcss, commonjs, eth-library, godot-kit, tailwind-elements-ui, runtimekit, spoint, fsbrowse, @ssgw/icon, neverthrow-js, hex-encode-utils): @sqlite-labs/*, @sqlite-table/*, @sqlite-prime/* all typosquat the SQLite/better-sqlite ecosystem; postcss-theme-provider, post-css-transfer typosquat postcss; commonjs-assert, commonjs-assertion typosquat the standard commonjs-assert namespace; eth-library-toolkit, eth-library-utils typosquat the Ethereum tooling ecosystem. Advisories for these carry only CWE-506 boilerplate ("fully compromised"), so blast radius is not fully characterised - treat each as capable of the same credential-theft / remote-shell / wallet-drain behaviour as the fully-analysed batch members until Socket / OpenSSF post the malicious-package sample

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the full 2026-08-10 package list below
2. 2For iconova-react or postcss-initial-provider matches (Cluster A - on-chain C2): block outbound traffic from the affected host to Ethereum RPCs (*.rpc.io, mainnet.infura.io, *.nodereal.io, *.getblock.io, *.llamarpc.com) and to any IPv4 reachable over HTTP that was resolved during the exposure window - the stage-2 C2 IP is fetched on-chain and rotates, so no static IOC catches it after publish time. Rebuild the affected host from bare metal, rotate every credential accessible to it, and correlate outbound flow logs during the install window with the Ethereum-transaction extraction pattern (a getTransaction/eth_getTransactionByHash call against a random-looking wallet followed by an HTTP GET to an IPv4 embedded in the calldata)
3. 3For svelte-kit-streak / kit-map-streak matches (Cluster B - map-streak-kit family): same remediation as 2026-08-08 map-streak-kit. Re-image the affected Linux host from bare metal, rotate every SSH key on the host (including any private key with the same fingerprint reused elsewhere), rotate every credential stored in env/config files, remove any systemd unit created in the exposure window
4. 4For @rblxts/services matches (Cluster C): uninstall, correct the typo to the real @rbxts/services (with rbxts, not rblxts). Any Windows host with a stored Roblox studio session, Roblox account cookie, or crypto wallet accessible to the Windows user must be considered compromised. Hunt for the anonymous-file-host-fetched .exe under %TEMP% and any executable spawned as a detached process during the install window
5. 5For @kuperka/chainguard-sdk matches (Cluster D - browser data-exfil): because this steals runtime browser state, treat the exposure window as if every session cookie, every stored password, every form value, and every wallet balance on any browser that loaded the package as exfiltrated. Rotate every credential and revoke every session that could plausibly have been exposed; assume the operator holds the wallet addresses displayed to the compromised users
6. 6For xerohub-discord-voice matches (Cluster E): rotate the Discord bot token, invalidate any bot deployment that used it, and audit the bot's guilds for unauthorised actions during the exposure window. Even though the current webhook is a placeholder, the stealer is fully wired - future republishes with a live webhook could re-drain tokens without changing the package fingerprint
7. 7For env-local matches (Cluster F - Windows persistent RAT): highest-severity remediation of the batch. Every affected Windows host has a live persistent remote-desktop RAT with keyboard + mouse control and periodic screen capture. Re-image from bare metal, remove %APPDATA%\ScreenCaptureClient and the HKCU\...\Run\ScreenCaptureClient registry entry, treat every credential entered on the host during the exposure window as compromised, and correlate outbound flow logs for the screen-capture upload pattern. Correct the typo to the real dotenv
8. 8For hex-encode-utils matches (Cluster G): block outbound to the hardcoded Cloudflare Workers hosts + the Telegram relay, remove ~/.cache/hex-encode-utils/modules/exec_runtime.py, hunt for the detached Python process, and rotate credentials on the host. CI runners are NOT immune - the sandbox-evasion check only exempts explicit CI/container environments; a developer's local dev container is a workstation to the check
9. 9For cryptostock / tokocrytodev matches (Cluster H): any private key stored under ~/.ssh, ~/.ethereum/keystore, or exposed via the ETH_PRIVATE_KEY env var during the exposure window must be considered exfiltrated and drained. Rotate every SSH key, move any remaining ETH balance out of every keystore, and audit Infura request logs for on-chain sweeps to 0x742d35Cc6634C0532925a3b844Bc454e4438f44e and neighbours
10. 10For simple-date-formatter-new-9 / -new-10 matches (Cluster I): block outbound to 124.221.154.135 at the network egress, verify no reverse-shell session survived the install (kill any bash -i process with an outbound connection to the C2), and treat the host as compromised if any live-session evidence is found
11. 11For polymarket-stake-mathss matches (Cluster J): block outbound to log-taker.store, correct the typo to the real polymarket-stake-math, and audit the extracted tarball's contents on any host that installed the package
12. 12*For chai-tracker matches or any `chai-as- sibling from the Cluster K/M list**: uninstall and audit for spawned detached child processes with suppressed output during the install window. Prefer chai-spies or sinon-chai` for the real functionality
13. 13*For `@noobaihome/amis- matches (Cluster L)**: internal Baidu network topology data has already been exfiltrated. If you operate inside Baidu, escalate to internal security. Configure .npmrc scope-to-registry mapping so @noobaihome` resolves only from your private mirror
14. 14For all Cluster M typosquat matches: uninstall, block the name in .npmrc, correct the typo to the intended package. Because the behavioural analysis is incomplete, prefer the full-compromise remediation posture (rotate credentials, re-image the host) unless a subsequent Socket/OpenSSF post narrows the risk
15. 15For all npm installs in CI, run with --ignore-scripts as defense-in-depth to prevent postinstall/preinstall payloads (mitigates Clusters A-J; does NOT mitigate K, which fires on chai.use() at runtime)
16. 16Verify none of the 2026-08-10 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-9hjr-qcfj-h3wj - iconova-react malicious loader with Ethereum RPC on-chain dead-drop C2

  github.com
  GitHub
• GHSA-9qww-697m-3rg3 - postcss-initial-provider Ethereum RPC dead-drop encrypted payload loader

  github.com
  GitHub
• GHSA-rc4p-g2mc-7w8h - svelte-kit-streak (map-streak-kit Linux-implant family continuation)

  github.com
  GitHub
• GHSA-7wwj-2mjc-pmxq - kit-map-streak (map-streak-kit Linux-implant family continuation)

  github.com
  GitHub
• GHSA-x6xv-2jr9-4pc5 - @rblxts/services typosquat Windows PowerShell zip drop (sibling of @rbx-ts/services)

  github.com
  GitHub
• GHSA-x3c3-qwj8-qfpc - @kuperka/chainguard-sdk Chainguard-impersonating browser data-exfil + wallet + keylogger

  github.com
  GitHub
• GHSA-mppv-3p7f-3fmq - xerohub-discord-voice Discord-token stealer (sendTokenToCreator webhook exfil)

  github.com
  GitHub
• GHSA-r3pr-mmg7-gr2j - env-local Windows persistent screen-capture + remote-control RAT (dotenv impersonator)

  github.com
  GitHub
• GHSA-2p54-jrq3-p4p9 - hex-encode-utils Cloudflare-Workers AES-GCM Python-payload loader

  github.com
  GitHub
• GHSA-vxm9-fcc8-7337 - cryptostock Infura wallet-drainer with badai.run.place C2

  github.com
  GitHub
• GHSA-m482-gfg4-jcp7 - tokocrytodev Infura wallet-drainer (0x742d35Cc.. attacker address)

  github.com
  GitHub
• GHSA-fq7m-frv3-2w4v - simple-date-formatter-new-9 bash reverse shell to 124.221.154.135:4444

  github.com
  GitHub
• GHSA-2qqg-9fjr-5mw9 - polymarket-stake-mathss log-taker.store loader (Polymarket typosquat)

  github.com
  GitHub
• GHSA-j2r4-fv2p-jjf8 - chai-tracker chai.use()-triggered detached-process C2 loader (chai-spies impersonator)

  github.com
  GitHub
• GHSA-jprv-2653-h4xc - @noobaihome/amis-simple-area-widget Baidu-internal dep-confusion SSRF probe

  github.com
  GitHub
• GHSA-932g-6p3v-rp3w - @noobaihome/amis-uni-area-widget dep-confusion sibling

  github.com
  GitHub
• GHSA-72h3-pwwh-68cx - spoint (0.1.695-0.1.700 CWE-506)

  github.com
  GitHub
• GHSA-mmpq-4w6p-rwg2 - tailwind-elements-ui

  github.com
  GitHub
• GHSA-v6qq-vq5x-rmxf - runtimekit

  github.com
  GitHub
• GHSA-pvvh-h7rh-2c7g - fsbrowse (<=0.2.28)

  github.com
  GitHub
• GHSA-j7m9-r9h4-rfw8 - godot-kit

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• ChainDrop npm worm analysis (Ethereum smart-contract-as-C2-registry pattern context)

  unit42.paloaltonetworks.com
  Palo Alto Unit 42