# GitHub Advisory npm CWE-506 sweep - 2026-08-11 batch (webhook.site Web3 typosquat credential-theft ring `@openzeppelin-4/5/contracts`+`@aerodrome-finance/contracts`+`@aerodrome-finance/slipstream`+`ethereum-vault-connector`, `safe-local-env-loader` env-local RAT sibling, `newtun` unencrypted-WebSocket PTY RAT with self-update, `svelte-vim-kit`+`kit-vim-map` map-streak-kit family continuation, `@nzeros/codebreak` Go ELF disguised as C solver, `base65-*` base-x typosquat cluster with 123KB obfuscated payload + `bs58-*` boilerplate siblings, coordinated `oastify.com`/`sslip.io`/webhook OAST dep-confusion recon beacons)

> 38 npm CWE-506 advisories published 2026-08-11. Headline: **five-package Web3 typosquat ring** (`@openzeppelin-4/contracts`, `@openzeppelin-5/contracts`, `@aerodrome-finance/contracts`, `@aerodrome-finance/slipstream`, `ethereum-vault-connector`) sharing the same `webhook.site` credential-exfil TTP with 60-240s detached-process delay + sandbox evasion, `safe-local-env-loader` continuing the [2026-08-10 `env-local`](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) Windows RAT, and `newtun` shipping a PTY reverse shell with self-update.

- Published: 2026-08-11
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 38 packages, 117 compromised versions
- Tags: typosquat, credential-theft, crypto-wallet-drain, dependency-confusion, obfuscation, infostealer
- Also known as: 2026-08-11 GHSA npm batch, Web3 SDK typosquat webhook.site ring, env-local RAT day-2, map-streak-kit family day-3, newtun 7ii.win WebSocket RAT
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security, amazon-inspector
- Incident ID: npm-2026-08-11-ghsa-malware-sweep

## Affected packages (38)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@aerodrome-finance/contracts](https://dependencywatch.io/package/npm/@aerodrome-finance/contracts) | npm | 1.0.0, 1.1.0, 1.1.1 |
| [@aerodrome-finance/slipstream](https://dependencywatch.io/package/npm/@aerodrome-finance/slipstream) | npm | 1.0.0, 1.1.0, 1.1.1 |
| [@dgn-src-click-to-pay-org/srcdcfreleasecert](https://dependencywatch.io/package/npm/@dgn-src-click-to-pay-org/srcdcfreleasecert) | npm | 999.0.1 |
| [@nzeros/codebreak](https://dependencywatch.io/package/npm/@nzeros/codebreak) | npm | 1.3.0 |
| [@openzeppelin-4/contracts](https://dependencywatch.io/package/npm/@openzeppelin-4/contracts) | npm | 1.0.0, 1.0.1 |
| [@openzeppelin-5/contracts](https://dependencywatch.io/package/npm/@openzeppelin-5/contracts) | npm | 1.0.0, 1.0.1 |
| [base65-11x](https://dependencywatch.io/package/npm/base65-11x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [base65-12x](https://dependencywatch.io/package/npm/base65-12x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [base65-13x](https://dependencywatch.io/package/npm/base65-13x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [base65-15x](https://dependencywatch.io/package/npm/base65-15x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [base65-33x](https://dependencywatch.io/package/npm/base65-33x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [base65-77x](https://dependencywatch.io/package/npm/base65-77x) | npm | 1.0.0, 2.0.0, 3.0.0, 4.0.0, 4.0.1, 5.0.0, 5.0.1, 5.0.2 |
| [bjm-low-code-components](https://dependencywatch.io/package/npm/bjm-low-code-components) | npm | 99.0.0 |
| [bs58-11](https://dependencywatch.io/package/npm/bs58-11) | npm | 1.0.0 |
| [bs58-12](https://dependencywatch.io/package/npm/bs58-12) | npm | 1.0.0 |
| [bs58-13](https://dependencywatch.io/package/npm/bs58-13) | npm | 1.0.0 |
| [chapters-core](https://dependencywatch.io/package/npm/chapters-core) | npm | 9.999.999 |
| [dakumangalsingh_virus](https://dependencywatch.io/package/npm/dakumangalsingh_virus) | npm | 1.0.0, 1.2.0, 1.3.0 |
| [dcfarguscert](https://dependencywatch.io/package/npm/dcfarguscert) | npm | 999.0.1 |
| [dependencyfsdsfdsfg](https://dependencywatch.io/package/npm/dependencyfsdsfdsfg) | npm | 99.9.0 |
| [developer-dashboard](https://dependencywatch.io/package/npm/developer-dashboard) | npm | 1.0.0 |
| [ethereum-vault-connector](https://dependencywatch.io/package/npm/ethereum-vault-connector) | npm | 1.0.0, 1.1.0, 1.1.1 |
| [fetch-runtime](https://dependencywatch.io/package/npm/fetch-runtime) | npm | 1.0.0 |
| [ghazaly](https://dependencywatch.io/package/npm/ghazaly) | npm | 99.9.0 |
| [internallib_v164](https://dependencywatch.io/package/npm/internallib_v164) | npm | 1.0.0 |
| [kit-vim-map](https://dependencywatch.io/package/npm/kit-vim-map) | npm | 1.0.0 |
| [lines-columns](https://dependencywatch.io/package/npm/lines-columns) | npm | 1.0.0 |
| [newtun](https://dependencywatch.io/package/npm/newtun) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19, 1.0.20, 1.0.21, 1.0.22, 1.0.23, 1.0.24, 1.0.25, 1.0.26, 1.0.27 |
| [node-internal-svg-loader](https://dependencywatch.io/package/npm/node-internal-svg-loader) | npm | 1.0.0 |
| [safe-local-env-loader](https://dependencywatch.io/package/npm/safe-local-env-loader) | npm | 1.0.0 |
| [sui-bcs-codec](https://dependencywatch.io/package/npm/sui-bcs-codec) | npm | 1.0.0 |
| [sui-gql-client](https://dependencywatch.io/package/npm/sui-gql-client) | npm | 1.0.0 |
| [svelte-vim-kit](https://dependencywatch.io/package/npm/svelte-vim-kit) | npm | 1.0.0 |
| [tilaver-mfa](https://dependencywatch.io/package/npm/tilaver-mfa) | npm | 1.0.0 |
| [tsihealth-client](https://dependencywatch.io/package/npm/tsihealth-client) | npm | 1.0.0 |
| [vite-svg-parse](https://dependencywatch.io/package/npm/vite-svg-parse) | npm | 1.0.0 |
| [whs4_ued](https://dependencywatch.io/package/npm/whs4_ued) | npm | 1.0.0 |
| [zeal-rq-hooks](https://dependencywatch.io/package/npm/zeal-rq-hooks) | npm | 0.0.0 |

## What happened

On 2026-08-11, the GitHub Advisory Database published **38 new npm CWE-506 (Embedded Malicious Code) advisories**. The batch has an unusually well-differentiated shape: a five-package Web3 typosquat ring sharing a single credential-exfil TTP, a continuation of the [2026-08-10 `env-local` Windows RAT](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) cross-porting to macOS, a self-updating WebSocket PTY RAT, further siblings of the map-streak-kit Linux implant family, a Go ELF disguised as a C solver, a nine-package base58 typosquat cluster, and a coordinated wave of internal-scope dep-confusion recon beacons hitting Discover / Samsung / other named target orgs.

## Cluster A - Web3 typosquat credential-theft ring (5 packages, shared webhook.site TTP)

| Package | Versions | GHSA | Impersonated target |
|---|---|---|---|
| `@openzeppelin-5/contracts` | `1.0.0`, `1.0.1` | GHSA-3px4-879m-x8q7 | `@openzeppelin/contracts` (v5) |
| `@openzeppelin-4/contracts` | `1.0.0`, `1.0.1` | GHSA-g472-m8m8-w6h3 | `@openzeppelin/contracts` (v4) |
| `@aerodrome-finance/contracts` | `1.0.0`, `1.1.0`, `1.1.1` | GHSA-wj9v-gmm3-32pv | Aerodrome Finance Solidity contracts |
| `@aerodrome-finance/slipstream` | `1.0.0`, `1.1.0`, `1.1.1` | GHSA-p457-j9cc-cpmp | Aerodrome Slipstream (Uniswap v3-style AMM) |
| `ethereum-vault-connector` | `1.0.0`, `1.1.0`, `1.1.1` | GHSA-4c5m-f9mr-jxrp | Euler Labs Ethereum Vault Connector |

**Shared TTP** (code fingerprint matches across all five):

1. Postinstall / preinstall hook filters `process.env` for `KEY`/`TOKEN`/`SECRET`/`PASS`/`PRIVATE`/`MNEMONIC`/`AWS`/`GITHUB`/`NPM`/`WALLET`.
2. Reads `~/.aws/`, `~/.ssh/`, `~/.kube/`, `~/.docker/`, `~/.netrc`, `~/.npmrc`, plus blockchain keystores under `~/.foundry/`, `~/.config/solana/`, Sui client config, and `gcloud`.
3. Serialises the payload and spawns a **detached Node child process** (`spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'})`) with a **randomised 60-240 second delay** before POSTing to a hardcoded `webhook.site` endpoint. `@openzeppelin-4/contracts` uses `webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`.
4. **Sandbox evasion**: checks hostnames against `scan-` / `detonation` / `honeypot` markers, checks the resolved npm registry, and throws early on non-standard hosts to defeat automated malware sandboxes.

The **shared code fingerprint plus a common webhook host register** places this squarely inside a single operator running a coordinated DeFi / Solidity SDK typosquat wave. Naming targets three high-value DeFi ecosystems (OpenZeppelin, Aerodrome Finance, Euler Labs) with the same exfil primitive - budget your remediation on the assumption further sibling drops targeting other DeFi SDKs (Uniswap, Compound, Aave, Morpho, Yearn) will land in the next 24-72h from the same operator.

## Cluster B - `safe-local-env-loader` env-local RAT sibling (1 package, cross-platform screen capture)

| Package | Versions | GHSA | Impersonated target | C2 |
|---|---|---|---|---|
| `safe-local-env-loader` | `1.0.0` | GHSA-4g37-2gh5-825v | `dotenv` | `192.99.204.157:5000` |

Masquerades as `dotenv`. Ships the **identical stack** to [`env-local` from 2026-08-10 Cluster F](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep): captures full desktop screenshots every 3 seconds on **both Windows and macOS**, transmits to the C2 with system metadata, polls the same C2 for mouse/keyboard commands and **replays them locally via `@nut-tree-fork/nut-js`**, and on Windows writes a VBS launcher + `HKCU\...\Run` registry entry for boot persistence. The activation stub is a **`require("./tui-options")` line appended to the legitimate dotenv init** so the agent fires when consumer code loads the module. Different C2 host than env-local (`192.99.204.157:5000` vs env-local's hardcoded upload target) but the code and the persistence layout match - same operator, second-day drop with a slightly widened OS surface (macOS added).

## Cluster C - `newtun` unencrypted-WebSocket PTY RAT with self-update (1 package, ws://pull.7ii.win:7999)

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `newtun` | `1.0.0`-`1.0.27` | GHSA-3xv7-433h-78x9 | `ws://pull.7ii.win:7999` |

Opens an unencrypted WebSocket to `pull.7ii.win:7999`, spawns **interactive PTY shells** for remote command execution, reads/writes/deletes/renames arbitrary files (`~/.ssh` and `~/.aws` explicitly named in the advisory as sensitive-path targets), transmits hostname + OS + arch + Node version + CPU/memory stats + network traffic every 5 seconds, and includes a **self-update primitive that installs new global versions of itself without user approval** - the operator rotates payload silently on any host still running the WebSocket. The `pull.7ii.win` egress is a durable IOC block target because the connection is unencrypted (deep-packet inspection can identify the WebSocket handshake without TLS interception).

## Cluster D - `svelte-vim-kit` + `kit-vim-map` map-streak-kit family third-day continuation (2 packages)

| Package | Versions | GHSA |
|---|---|---|
| `svelte-vim-kit` | `>=0` (`1.0.0`) | GHSA-rvh4-87p7-h5pm |
| `kit-vim-map` | `>=0` (`1.0.0`) | GHSA-mj69-vr76-h2mq |

Both carry only the boilerplate CWE-506 text on the GHSA advisory pages. The naming morphology (`svelte-*-kit`, `kit-*-map`) and the batch timing places them squarely inside the map-streak-kit implant family established in the [2026-08-08 batch](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep) (`map-streak-kit`, `streak-map-kit`, `svelte-streak-kit`, `svelte-kit-cache`) and continued in the [2026-08-10 batch](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) (`svelte-kit-streak`, `kit-map-streak`). Third consecutive daily drop from this operator - the current register pattern is `<framework>-<editor>-kit` and `kit-<editor>-map`.

## Cluster E - `@nzeros/codebreak` Go ELF disguised as C solver (1 package, Linux x64 auto-exec)

| Package | Versions | GHSA |
|---|---|---|
| `@nzeros/codebreak` | `1.3.0` | GHSA-jwj4-j62g-2xg8 |

Advertises itself as a C minimax solver. Ships three vendor binaries: `vendor/solver-darwin-arm64` is a legitimate ~34KB Mach-O, but **`vendor/solver-darwin-x64` and `vendor/solver-linux-x64` are byte-identical 33.6MB Linux Go ELF binaries** linked against network clients, process-execution utilities, and cryptographic libraries - entirely inconsistent with a solver algorithm. A **postinstall script auto-executes the Linux binary on Linux x64 systems** during `npm install`. The Go binaries are opaque and cannot be verified to match the advertised C source.

## Cluster F - Base58 typosquat cluster (`base65-*` runtime hook + `bs58-*` boilerplate siblings, 9 packages)

**`base65-*` (obfuscated payload, runtime hooks)**

| Package | Versions | GHSA |
|---|---|---|
| `base65-11x` | `<=5.0.2` | GHSA-7ww3-26rx-3cpf, GHSA-39c6-h85q-hpcw |
| `base65-12x` | `<=5.0.2` | GHSA-q6r6-qrfx-v3wp, GHSA-c4w7-m3hx-xx75 |
| `base65-13x` | `<=5.0.2` | GHSA-pm9q-qccp-rj4g, GHSA-fp83-xcpx-v3qm |
| `base65-15x` | `<=5.0.2` | GHSA-m962-7hqx-p4h8 |
| `base65-33x` | `<=5.0.2` | GHSA-q6wg-mgq7-rq2h |
| `base65-77x` | `<=5.0.2` | GHSA-72rx-9qc9-2c73 |

Each ships the **legitimate `base-x` source followed by a ~123KB top-level obfuscated block** that installs dispatchers on `globalThis` under registries `vmr_3f4688` and `vmw_bf472f`, manipulates `Object.defineProperty` and `__proto__` to intercept object operations, and calls `fetch` from inside the obfuscated block. Runs unconditionally on `require`/`import` in both CJS and ESM.

**`bs58-*` (boilerplate CWE-506, likely siblings)**

| Package | Versions | GHSA |
|---|---|---|
| `bs58-11` | `>=0` | GHSA-mw39-7442-3p8m |
| `bs58-12` | `>=0` | GHSA-x9c8-g63x-mh7q |
| `bs58-13` | `>=0` | GHSA-72pr-qcvq-fgpg |

The naming shift (`base65-Nx` vs `bs58-N`) strongly implies sibling drops from the same operator staging both base58-encoding-library typosquat registers in parallel. The real target packages are `base-x` (multibase encoder) and `bs58` (base58 for Bitcoin) - both are popular deps in the Solana / Bitcoin / Ethereum tooling ecosystems.

## Cluster G - Coordinated dep-confusion / OAST recon beacon wave (8 packages, multiple destinations)

| Package | Version | GHSA | Beacon destination | Notable |
|---|---|---|---|---|
| `@dgn-src-click-to-pay-org/srcdcfreleasecert` | `999.0.1` | GHSA-hfmm-qxg4-g578 | Bare-IP HTTP endpoint | Impersonates Discover/SRC click-to-pay; PAN/Luhn cover code |
| `dcfarguscert` | `999.0.1` | GHSA-mf24-fh58-62x2 | `http://16-171-38-148.sslip.io:8080/api/install` | `npm ls -g` global-package inventory exfil |
| `bjm-low-code-components` | `99.0.0` | GHSA-r8w4-qgmq-q94q | `2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary` | Burp Collaborator OAST |
| `chapters-core` | `9.999.999` | GHSA-f5jm-mx92-p845 | `awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun` | Leaves `samsung-depconf-poc.json` marker |
| `ghazaly` | `99.9.0` | GHSA-2j9m-4gmh-3m8p | `xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com` | Shared OAST endpoint with `dependencyfsdsfdsfg` |
| `dependencyfsdsfdsfg` | `99.9.0` | GHSA-5928-vc2p-hrqj | `xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com` | Shared OAST endpoint with `ghazaly` |
| `whs4_ued` | `1.0.0` | GHSA-v5xx-cpfg-4c3j | Discord webhook `1530599209269465319` | Runtime string-concat token to evade static detection |
| `zeal-rq-hooks` | `0.0.0` | GHSA-62m8-8rfw-gv5v | `npm-canary.aveliscare.com` | Amazon Inspector detection |

The concentration of Samsung / Discover / internal-scope dep-confusion probes on a single day suggests **multiple red teams (or attackers) are actively enumerating internal scopes**. The `ghazaly` + `dependencyfsdsfdsfg` shared endpoint means those two are demonstrably the **same operator** running two probes in parallel.

## Cluster H - `sui-gql-client` + `sui-bcs-codec` Sui blockchain typosquat pair (2 packages)

| Package | Versions | GHSA | Typosquats |
|---|---|---|---|
| `sui-gql-client` | `>=0` | GHSA-2ggf-86xw-xjp5 | `@mysten/sui/graphql/client` |
| `sui-bcs-codec` | `>=0` | GHSA-2wqc-3243-4hxm | `@mysten/bcs` |

Boilerplate CWE-506 on both advisory pages, but naming targets the [official Sui blockchain `@mysten/*` scope](https://sdk.mystenlabs.com/typescript). Treat as capable of the same wallet-key theft / credential-exfil behaviour as the Cluster A ring until Socket or OpenSSF post the malicious-package sample.

## Cluster I - Boilerplate CWE-506 drops (9 packages, behaviour uncharacterised)

`internallib_v164` (GHSA-3qvf-g7pq-m3m3), `tsihealth-client` (GHSA-jcwv-5jc7-grp5), `tilaver-mfa` (GHSA-4j5x-wjw6-qvq5), `developer-dashboard` (GHSA-vf74-54mr-mp44), `fetch-runtime` (GHSA-3hqj-592v-g33j), `vite-svg-parse` (GHSA-v7x8-w6xp-6mv4), `node-internal-svg-loader` (GHSA-9rgf-6m2p-q73f), `lines-columns` (GHSA-572q-x4v9-m474), `dakumangalsingh_virus` (GHSA-ppp3-vpgx-2v73). All ship the standard "any computer that has this package installed or running should be considered fully compromised" text. Naming implies target categories: `internallib_v164` and `developer-dashboard` are internal-scope dep-confusion lures; `tilaver-mfa` typosquats MFA tooling; `vite-svg-parse` and `node-internal-svg-loader` typosquat Vite / Node SVG loader plugins; `fetch-runtime` and `lines-columns` typosquat standard utilities.

## Registry state

All 38 packages yanked or security-holding-replaced from npm during the 2026-08-11 takedown window. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before takedown will keep serving the malicious versions.

## Related tracked activity

- **env-local / safe-local-env-loader Windows/macOS screen-capture RAT register**: Cluster B is the second-day drop of the [2026-08-10 `env-local` Cluster F Windows RAT](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep). Same operator, macOS surface added.
- **map-streak-kit Linux implant family**: Cluster D is the third consecutive daily drop of the family established on [2026-08-08](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep) and continued on [2026-08-10](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep).
- **Web3 SDK typosquat register**: Cluster A is a coordinated wave against DeFi SDKs (OpenZeppelin, Aerodrome, Euler). Expect further sibling drops in the next 24-72h targeting Uniswap, Compound, Aave, Morpho, Yearn.
- Discovery credits: `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `npm Security`, `amazon-inspector`. No named threat actor.

## Impact

- **Cluster A - Web3 typosquat credential-theft ring (5 packages, shared webhook.site TTP)**: `@openzeppelin-4/contracts@1.0.0..1.0.1`, `@openzeppelin-5/contracts@1.0.0..1.0.1`, `@aerodrome-finance/contracts@1.0.0..1.1.1`, `@aerodrome-finance/slipstream@1.0.0..1.1.1`, and `ethereum-vault-connector@1.0.0..1.1.1` all execute the **same postinstall payload**: filter `process.env` for `KEY`/`TOKEN`/`SECRET`/`PASS`/`PRIVATE`/`MNEMONIC`/`AWS`/`GITHUB`/`NPM`/`WALLET`; read `~/.aws/`, `~/.ssh/`, `~/.kube/`, `~/.docker/`, `~/.netrc`, `~/.npmrc`, blockchain keystores (Foundry, Solana, Sui, gcloud); **`spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'})` with a randomised 60-240 second delay** to outlive install-time scanning windows; POST the bundle to a hardcoded `webhook.site` endpoint (`@openzeppelin-4/contracts` uses `webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`); **sandbox-evasion checks** for `scan-`/`detonation`/`honeypot` hostnames and non-standard registries. Same code fingerprint across all five packages - a single operator running a coordinated DeFi/Solidity SDK typosquat wave
- **Cluster B - `safe-local-env-loader` Windows/macOS screen-capture + remote-control implant (env-local Aug-10 sibling)**: `safe-local-env-loader@1.0.0` masquerades as `dotenv` (same target as [`env-local` from 2026-08-10 Cluster F](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep)) and ships the **identical screen-capture-every-3-seconds + mouse/keyboard replay via `@nut-tree-fork/nut-js` + VBS + `HKCU\...\Run` persistence** stack, but this drop uses a **different C2** (`192.99.204.157:5000` vs env-local's stack) and captures on **both Windows and macOS** rather than Windows-only. Appends `require("./tui-options")` to the legitimate dotenv init to activate the agent when the module loads. Any developer workstation that pulled it gets a live persistent remote-desktop RAT with cross-platform screen capture
- **Cluster C - `newtun` unencrypted-WebSocket PTY RAT with self-update (`pull.7ii.win:7999`)**: `newtun@1.0.0..1.0.27` opens an unencrypted WebSocket to `pull.7ii.win:7999`, spawns interactive PTY shells for remote command execution, reads/writes/deletes/renames arbitrary files (`~/.ssh`, `~/.aws` explicitly named), transmits hostname + OS + arch + Node version + CPU/memory/network stats **every 5 seconds**, and includes a **self-update primitive that installs new global versions of itself without user approval** - the operator can rotate payload silently on any host still running the WebSocket. Any host that installed newtun should be considered fully compromised at the OS + credential + persistence level, and the WebSocket egress point is a durable IOC block target
- **Cluster D - `svelte-vim-kit` + `kit-vim-map` map-streak-kit implant family continuation**: `svelte-vim-kit` and `kit-vim-map` carry only boilerplate CWE-506 on their GHSA pages, but the naming morphology (`svelte-*-kit`, `kit-*-map`) puts them squarely in the [2026-08-08 `map-streak-kit` cluster](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep) and the [2026-08-10 `svelte-kit-streak`/`kit-map-streak` continuation](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep). The 08-08 batch established a Linux binary implant with systemd persistence, C2 beacon to `217.60.77.63`, and SSH-key + credential exfil - treat these two as sibling drops of the same implant family until Socket or OpenSSF post a differentiated sample. Third day in a row this operator has published the same-shape package pair
- **Cluster E - `@nzeros/codebreak` Go ELF disguised as C minimax solver (Linux x64 auto-exec)**: `@nzeros/codebreak@1.3.0` ships **three "vendor" binaries** - `vendor/solver-darwin-arm64` is a legitimate ~34KB Mach-O, but **`vendor/solver-darwin-x64` and `vendor/solver-linux-x64` are byte-identical 33.6MB Linux Go ELF binaries** linked against network + process-execution + crypto libraries entirely inconsistent with a solver algorithm. A **postinstall script auto-executes the Linux binary on Linux x64 systems** during `npm install`. The Go binaries are opaque and cannot be verified to match the advertised C source. Any Linux x64 workstation or CI runner that pulled the package must be treated as compromised at the native-code level
- **Cluster F - Base58 typosquat cluster (`base65-*` obfuscated payload + `bs58-*` boilerplate siblings, 9 packages)**: `base65-11x`, `base65-12x`, `base65-13x`, `base65-15x`, `base65-33x`, `base65-77x` each ship the **legitimate `base-x` source followed by a ~123KB top-level obfuscated block** that installs dispatchers on `globalThis` under registries `vmr_3f4688` and `vmw_bf472f`, manipulates `Object.defineProperty` and `__proto__` to intercept object operations, and calls `fetch` from inside the obfuscated block - **runs unconditionally on `require`/`import` in both CJS and ESM**. `bs58-11`, `bs58-12`, `bs58-13` carry only boilerplate CWE-506 but the naming shift (`base65-Nx` vs `bs58-N`) strongly implies sibling drops from the same operator staging both base58-encoding-library typosquat registers in parallel. Any process that loaded a `base65-*` package must be considered runtime-hooked - the `Object.defineProperty` monkey-patching means subsequent property reads/writes in the same process can be intercepted
- **Cluster G - Coordinated dep-confusion / OAST recon beacon wave (8 packages, multiple destinations)**: `@dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1` and `dcfarguscert@999.0.1` are **dep-confusion probes targeting Discover / SRC (click-to-pay) payment infrastructure** - both use inflated `999.0.1` versions, both beacon to bare-IP HTTP endpoints (`dcfarguscert` uses `http://16-171-38-148.sslip.io:8080/api/install` with full `npm ls -g` exfil; `srcdcfreleasecert` POSTs package + host metadata to a hardcoded bare-IP endpoint), and both include token/PAN-validation stub code as cover. `bjm-low-code-components@99.0.0`, `chapters-core@9.999.999` (leaves a `samsung-depconf-poc.json` marker file), `ghazaly@99.9.0`, `dependencyfsdsfdsfg@99.9.0` (identical `xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com` endpoint - same operator), and `whs4_ued@1.0.0` (Discord webhook exfil, runtime string-concat token to evade detection) all beacon to Burp Collaborator OAST subdomains or Discord webhooks. `zeal-rq-hooks@0.0.0` beacons to `npm-canary.aveliscare.com`. Blast radius per package is small (installer metadata only), but the concentration of Samsung/Discover/internal-scope dep-confusion probes on a single day suggests **multiple red teams (or attackers) are actively enumerating internal scopes** - if you operate at any named target org and see your `@<org>` scope resolving to a public package, escalate to internal security
- **Cluster H - `sui-gql-client` + `sui-bcs-codec` Sui blockchain typosquat pair**: both carry only boilerplate CWE-506 on the GHSA pages ("fully compromised"), but naming targets the [Sui blockchain's official `@mysten/*` scope](https://sdk.mystenlabs.com/typescript) - `sui-gql-client` typosquats `@mysten/sui/graphql/client` and `sui-bcs-codec` typosquats `@mysten/bcs`. Treat as capable of the same wallet-key theft / credential-exfil behaviour as the fully-analysed Cluster A ring until Socket or OpenSSF post the malicious-package sample
- **Cluster I - Boilerplate CWE-506 drops (9 packages, behaviour uncharacterised)**: `internallib_v164`, `tsihealth-client`, `tilaver-mfa`, `developer-dashboard`, `fetch-runtime`, `vite-svg-parse`, `node-internal-svg-loader`, `lines-columns`, `dakumangalsingh_virus` all ship the standard "any computer that has this package installed or running should be considered fully compromised" text without a differentiated behavioural analysis. Blast radius is not fully characterised - treat each as capable of the same credential-theft / remote-shell / wallet-drain behaviour as the fully-analysed batch members until Socket / OpenSSF post the malicious-package sample. Names imply targets: `internallib_v164` and `developer-dashboard` are internal-scope dep-confusion lures; `tilaver-mfa` typosquats MFA tooling; `fetch-runtime` and `lines-columns` typosquat standard utilities; `vite-svg-parse` and `node-internal-svg-loader` typosquat Vite / Node SVG loader plugins

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-11 package list below
2. **For any Cluster A match (`@openzeppelin-4/contracts`, `@openzeppelin-5/contracts`, `@aerodrome-finance/contracts`, `@aerodrome-finance/slipstream`, `ethereum-vault-connector`)**: assume every AWS credential, SSH key, `.npmrc`/`.netrc` token, Kubernetes config, Docker config, blockchain keystore (Foundry / Solana / Sui / gcloud), and every `process.env` value matching the KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/AWS/GITHUB/NPM/WALLET filter has been exfiltrated to `webhook.site`. **Rotate every credential accessible to the host during the exposure window**, drain every wallet whose private key or seed phrase lived on the host, and re-image the host from bare metal. Correct the typo to the intended package (`@openzeppelin/contracts` for the OZ ring; `@aerodrome-finance/*` maps to the real Aerodrome Finance packages published under a legitimate Aerodrome scope; `ethereum-vault-connector` maps to the Euler Labs Ethereum Vault Connector repo). Because the exfil fires as a **detached child process with a randomised 60-240 second delay**, install-time scanners that watch only the install process itself will miss it - correlate outbound flow logs during the 4-minute window after any Cluster A install
3. **For `safe-local-env-loader` matches (Cluster B - dotenv impersonator RAT)**: same posture as the [2026-08-10 `env-local` remediation](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep). Re-image the affected Windows or macOS host from bare metal, remove `%APPDATA%\ScreenCaptureClient` and the `HKCU\...\Run\ScreenCaptureClient` registry entry (Windows), remove any equivalent launch-agent plist (macOS), treat every credential entered on the host during the exposure window as compromised, and **block outbound to `192.99.204.157:5000` at the network egress**. Correct the typo to the real `dotenv`
4. **For `newtun` matches (Cluster C - WebSocket PTY RAT)**: **block outbound to `pull.7ii.win:7999` at the network egress immediately** - the WebSocket is unencrypted, so the connection can be terminated at a plain TCP filter. Kill any process holding an outbound connection to that endpoint. Rotate every credential on the host, uninstall the global self-updated versions of `newtun` (`npm uninstall -g newtun` on every host), and re-image. Because the RAT self-updates without user approval, a stale removal that leaves the WebSocket running will re-install fresh binaries
5. **For `svelte-vim-kit` / `kit-vim-map` matches (Cluster D - map-streak-kit family)**: same remediation as [2026-08-08 map-streak-kit](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep) and [2026-08-10 svelte-kit-streak/kit-map-streak](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep). Re-image the affected Linux host from bare metal, rotate every SSH key on the host, rotate every credential stored in env/config files, remove any systemd unit created in the exposure window. Third consecutive daily drop from this operator - the naming register is now `<framework>-<editor>-kit` and `kit-<editor>-map`; block that morphology in your name-scanner if you can
6. **For `@nzeros/codebreak` matches (Cluster E - Go ELF disguised as C solver)**: uninstall, delete the `vendor/` directory contents (in particular the 33.6MB `solver-linux-x64` and `solver-darwin-x64` binaries), hunt for the postinstall-spawned process, and treat any Linux x64 host or CI runner that installed the package as compromised at the native-code level. The Mach-O `darwin-arm64` binary is legitimate but do not use it as evidence the package is safe - the Linux binary loaded network + process-execution + crypto libraries
7. **For any `base65-*` match (Cluster F - base-x typosquat with runtime `Object.defineProperty` hook)**: because the obfuscated payload monkey-patches `Object.defineProperty` and `__proto__` at load time, **any subsequent property read/write in the same Node process can be intercepted**. Rotate any credentials or private keys that lived in memory during the process's lifetime, kill any long-running Node process that loaded the package, and audit outbound flow logs for the `fetch` calls the obfuscated payload makes. For `bs58-*` matches: block the name and correct to the real `bs58` package. Prefer the vendor-official `base-x` for base-N encoding needs
8. **For any Cluster G recon-beacon match**: internal-scope reconnaissance data (hostname, username, cwd, `npm ls -g` global-package inventory, IPv4 addresses) has already been exfiltrated. Configure `.npmrc` scope-to-registry mapping so `@dgn-src-click-to-pay-org/*`, `@bjm/*`, and other internal scopes resolve **only from your private mirror**. If you operate inside Discover / SRC / Samsung / any of the named target organisations, escalate to internal security - multiple actors are actively enumerating your internal scopes. Rotate any credential that might be inferable from the exfil (hostname + npm-installed-package list gives an operator a full attack surface map)
9. **For `sui-gql-client` / `sui-bcs-codec` matches (Cluster H - Sui typosquat pair)**: uninstall, correct the typo to the real `@mysten/sui` / `@mysten/bcs`, and treat as capable of the same wallet-key theft / credential-exfil behaviour as Cluster A until Socket or OpenSSF post the malicious-package sample
10. For all Cluster I boilerplate matches: uninstall, block the name in `.npmrc`, correct the typo to the intended package. Because the behavioural analysis is incomplete, prefer the full-compromise remediation posture (rotate credentials, re-image the host) unless a subsequent Socket/OpenSSF post narrows the risk
11. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent postinstall/preinstall payloads (mitigates Clusters A, B, C, E, G; does NOT mitigate F, which fires on `require`/`import` at runtime)
12. Verify none of the 2026-08-11 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-3px4-879m-x8q7 - @openzeppelin-5/contracts credential-theft (webhook.site + 60-240s delayed detached process)](https://github.com/advisories/GHSA-3px4-879m-x8q7) - GitHub
- [GHSA-g472-m8m8-w6h3 - @openzeppelin-4/contracts credential-theft (shared webhook.site TTP with @openzeppelin-5/contracts)](https://github.com/advisories/GHSA-g472-m8m8-w6h3) - GitHub
- [GHSA-p457-j9cc-cpmp - @aerodrome-finance/slipstream credential-theft (Aerodrome Finance typosquat)](https://github.com/advisories/GHSA-p457-j9cc-cpmp) - GitHub
- [GHSA-wj9v-gmm3-32pv - @aerodrome-finance/contracts credential-theft sibling](https://github.com/advisories/GHSA-wj9v-gmm3-32pv) - GitHub
- [GHSA-4c5m-f9mr-jxrp - ethereum-vault-connector credential-theft (Euler Labs impersonator, shared TTP)](https://github.com/advisories/GHSA-4c5m-f9mr-jxrp) - GitHub
- [GHSA-4g37-2gh5-825v - safe-local-env-loader Windows+macOS screen-capture RAT (env-local Cluster F sibling, 192.99.204.157:5000)](https://github.com/advisories/GHSA-4g37-2gh5-825v) - GitHub
- [GHSA-3xv7-433h-78x9 - newtun unencrypted-WebSocket PTY RAT with self-update (pull.7ii.win:7999)](https://github.com/advisories/GHSA-3xv7-433h-78x9) - GitHub
- [GHSA-rvh4-87p7-h5pm - svelte-vim-kit (map-streak-kit family third-day continuation)](https://github.com/advisories/GHSA-rvh4-87p7-h5pm) - GitHub
- [GHSA-mj69-vr76-h2mq - kit-vim-map (map-streak-kit family third-day continuation)](https://github.com/advisories/GHSA-mj69-vr76-h2mq) - GitHub
- [GHSA-jwj4-j62g-2xg8 - @nzeros/codebreak Go ELF disguised as C solver (Linux x64 auto-exec)](https://github.com/advisories/GHSA-jwj4-j62g-2xg8) - GitHub
- [GHSA-q6r6-qrfx-v3wp - base65-12x base-x typosquat with 123KB obfuscated payload + Object.defineProperty hook](https://github.com/advisories/GHSA-q6r6-qrfx-v3wp) - GitHub
- [GHSA-72pr-qcvq-fgpg - bs58-13 (boilerplate CWE-506, base58 typosquat sibling)](https://github.com/advisories/GHSA-72pr-qcvq-fgpg) - GitHub
- [GHSA-hfmm-qxg4-g578 - @dgn-src-click-to-pay-org/srcdcfreleasecert Discover/SRC payment dep-confusion probe](https://github.com/advisories/GHSA-hfmm-qxg4-g578) - GitHub
- [GHSA-mf24-fh58-62x2 - dcfarguscert dep-confusion probe with sslip.io endpoint (npm ls -g exfil)](https://github.com/advisories/GHSA-mf24-fh58-62x2) - GitHub
- [GHSA-r8w4-qgmq-q94q - bjm-low-code-components Burp Collaborator OAST recon beacon](https://github.com/advisories/GHSA-r8w4-qgmq-q94q) - GitHub
- [GHSA-f5jm-mx92-p845 - chapters-core Samsung dep-confusion PoC (samsung-depconf-poc.json marker)](https://github.com/advisories/GHSA-f5jm-mx92-p845) - GitHub
- [GHSA-2j9m-4gmh-3m8p - ghazaly OAST recon beacon (shared endpoint with dependencyfsdsfdsfg)](https://github.com/advisories/GHSA-2j9m-4gmh-3m8p) - GitHub
- [GHSA-5928-vc2p-hrqj - dependencyfsdsfdsfg OAST recon beacon (shared endpoint with ghazaly)](https://github.com/advisories/GHSA-5928-vc2p-hrqj) - GitHub
- [GHSA-v5xx-cpfg-4c3j - whs4_ued Discord webhook exfil (runtime string-concat token)](https://github.com/advisories/GHSA-v5xx-cpfg-4c3j) - GitHub
- [GHSA-62m8-8rfw-gv5v - zeal-rq-hooks aveliscare.com beacon (Amazon Inspector detection)](https://github.com/advisories/GHSA-62m8-8rfw-gv5v) - GitHub
- [GHSA-2ggf-86xw-xjp5 - sui-gql-client (Sui blockchain @mysten/sui typosquat)](https://github.com/advisories/GHSA-2ggf-86xw-xjp5) - GitHub
- [GHSA-2wqc-3243-4hxm - sui-bcs-codec (Sui blockchain @mysten/bcs typosquat)](https://github.com/advisories/GHSA-2wqc-3243-4hxm) - GitHub
- [GHSA-3qvf-g7pq-m3m3 - internallib_v164 (internal-scope dep-confusion lure, boilerplate CWE-506)](https://github.com/advisories/GHSA-3qvf-g7pq-m3m3) - GitHub
- [GHSA-jcwv-5jc7-grp5 - tsihealth-client (boilerplate CWE-506)](https://github.com/advisories/GHSA-jcwv-5jc7-grp5) - GitHub
- [GHSA-4j5x-wjw6-qvq5 - tilaver-mfa (boilerplate CWE-506, MFA-tooling typosquat)](https://github.com/advisories/GHSA-4j5x-wjw6-qvq5) - GitHub
- [GHSA-vf74-54mr-mp44 - developer-dashboard (boilerplate CWE-506, internal-scope lure)](https://github.com/advisories/GHSA-vf74-54mr-mp44) - GitHub
- [GHSA-3hqj-592v-g33j - fetch-runtime (boilerplate CWE-506)](https://github.com/advisories/GHSA-3hqj-592v-g33j) - GitHub
- [GHSA-v7x8-w6xp-6mv4 - vite-svg-parse (boilerplate CWE-506, Vite plugin typosquat)](https://github.com/advisories/GHSA-v7x8-w6xp-6mv4) - GitHub
- [GHSA-9rgf-6m2p-q73f - node-internal-svg-loader (boilerplate CWE-506, Node loader typosquat)](https://github.com/advisories/GHSA-9rgf-6m2p-q73f) - GitHub
- [GHSA-572q-x4v9-m474 - lines-columns (boilerplate CWE-506)](https://github.com/advisories/GHSA-572q-x4v9-m474) - GitHub
- [GHSA-ppp3-vpgx-2v73 - dakumangalsingh_virus (boilerplate CWE-506)](https://github.com/advisories/GHSA-ppp3-vpgx-2v73) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).