# GitHub Advisory npm CWE-506 sweep - 2026-08-13 batch (`ltidisafe` GCS dep-confusion dropper ring `check-audit`+`cspell-esm`+`eslint-publish-release`+`in-install`+`knip-bun`+`resolve-audit`+`napi-raw`, `31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit `vexium-kit`+`ventra-kit`+`velora-kit`+`vortex-kit`+`copytrade-core`+`prediction-trader`, `@hzero-front-ui/*` internal-scope dep-confusion 5-package cluster with `callback.m0chan.co.uk` DNS+HTTPS beacon, `@khaznatech/*` webhook.site preinstall exfil 3-pack, `jchunt.top` telemetry-canary series `wct-st`+`tizen-webdriver-cli`, `8.135.48.40:4444` reverse-shell date-fmt masquerade pair `datefmt-util-helper`+`date-fmt-helper-xz`, `notafollower` AWS IMDSv2 credential theft, `bs58-15` base58 typosquat via `base65-15x` transitive, `@solana-js/web3` Windows PowerShell + `files.catbox.moe` RCE, `postcss-initialize-plugin` Ethereum-RPC-C2 continuation, `mutex-forge` Telegram+Slack+Ethereum-Sepolia RAT, `chai-as-reformed`+`process-live-log`+`external-process-live-log`+`minimalistic-assert-plus` Function-constructor R-shell family, `node-config-svg-contract` eval-from-URL, `nc-verify-127942`+`@jacksher/install-exec-poc` OAST recon POCs, `cilm-ui-commons` pipedream.net preinstall, ~10 boilerplate CWE-506)

> ~50 npm CWE-506 advisories published 2026-08-13. Headline: **`ltidisafe` GCS dep-confusion dropper ring** (7+ hollow-shell packages at v99.9.1 pinning `ltidisafe` as an `https://ltidi.storage.googleapis.com/depenconf/` tarball to bypass npm registry review); **`31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit family** (`vexium-kit`, `ventra-kit`, `velora-kit`, `vortex-kit`, `copytrade-core`, `prediction-trader` - all fetch `/icons/108|116` and `eval()` a `credits` field with `@primno/dpapi`+`better-sqlite3`+`node-machine-id` bundled for browser-cred theft); and a **`@hzero-front-ui/*` 5-package internal-scope dep-confusion cluster** beaconing to `callback.m0chan.co.uk`.

- Published: 2026-08-13
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 46 packages, 87 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, crypto-wallet-drain, infostealer, obfuscation
- Also known as: 2026-08-13 GHSA npm batch, ltidisafe GCS dropper ring, 31.97.137.157:45000 kit family, @hzero-front-ui dep-confusion probe, @khaznatech dep-confusion probe, jchunt.top telemetry-canary series
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector, kam193 bad-packages
- Incident ID: npm-2026-08-13-ghsa-malware-sweep

## Affected packages (46)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@hzero-front-ui/c7n-ui](https://dependencywatch.io/package/npm/@hzero-front-ui/c7n-ui) | npm | 99.99.99 |
| [@hzero-front-ui/cfg](https://dependencywatch.io/package/npm/@hzero-front-ui/cfg) | npm | 99.99.99 |
| [@hzero-front-ui/core](https://dependencywatch.io/package/npm/@hzero-front-ui/core) | npm | 99.99.99 |
| [@hzero-front-ui/hzero-ui](https://dependencywatch.io/package/npm/@hzero-front-ui/hzero-ui) | npm | 99.99.99 |
| [@hzero-front-ui/themes](https://dependencywatch.io/package/npm/@hzero-front-ui/themes) | npm | 99.99.99 |
| [@jacksher/install-exec-poc](https://dependencywatch.io/package/npm/@jacksher/install-exec-poc) | npm | 1.0.0, 1.0.2 |
| [@khaznatech/common](https://dependencywatch.io/package/npm/@khaznatech/common) | npm | 99.0.0 |
| [@khaznatech/core](https://dependencywatch.io/package/npm/@khaznatech/core) | npm | 99.0.0 |
| [@khaznatech/utils](https://dependencywatch.io/package/npm/@khaznatech/utils) | npm | 99.0.0 |
| [@leonardo0902/vortex-kit](https://dependencywatch.io/package/npm/@leonardo0902/vortex-kit) | npm | 12.0.2 |
| [@solana-js/web3](https://dependencywatch.io/package/npm/@solana-js/web3) | npm | 1.91.3 |
| [ai-analyzer](https://dependencywatch.io/package/npm/ai-analyzer) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17, 1.0.18, 1.0.19 |
| [bs58-15](https://dependencywatch.io/package/npm/bs58-15) | npm | 6.0.0, 6.0.1 |
| [chai-as-reformed](https://dependencywatch.io/package/npm/chai-as-reformed) | npm | 1.2.0 |
| [check-audit](https://dependencywatch.io/package/npm/check-audit) | npm | 99.9.1 |
| [cilm-ui-commons](https://dependencywatch.io/package/npm/cilm-ui-commons) | npm | 1.1.0 |
| [copytrade-core](https://dependencywatch.io/package/npm/copytrade-core) | npm | 2.3.0 |
| [cspell-esm](https://dependencywatch.io/package/npm/cspell-esm) | npm | 99.9.1 |
| [date-fmt-helper-xz](https://dependencywatch.io/package/npm/date-fmt-helper-xz) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [datefmt-util-helper](https://dependencywatch.io/package/npm/datefmt-util-helper) | npm | 1.0.0, 1.0.1 |
| [debug-proxy-chrome-devtools](https://dependencywatch.io/package/npm/debug-proxy-chrome-devtools) | npm | 1.0.1, 1.0.2 |
| [eslint-generate-prerelease](https://dependencywatch.io/package/npm/eslint-generate-prerelease) | npm | 99.9.1 |
| [eslint-generate-release](https://dependencywatch.io/package/npm/eslint-generate-release) | npm | 99.9.1 |
| [eslint-publish-release](https://dependencywatch.io/package/npm/eslint-publish-release) | npm | 99.9.1 |
| [external-process-live-log](https://dependencywatch.io/package/npm/external-process-live-log) | npm | 13.5.2 |
| [in-install](https://dependencywatch.io/package/npm/in-install) | npm | 99.9.1 |
| [knip-bun](https://dependencywatch.io/package/npm/knip-bun) | npm | 99.9.1 |
| [minimalistic-assert-plus](https://dependencywatch.io/package/npm/minimalistic-assert-plus) | npm | 1.1.7 |
| [mutex-forge](https://dependencywatch.io/package/npm/mutex-forge) | npm | 2.0.1, 2.0.2 |
| [napi-raw](https://dependencywatch.io/package/npm/napi-raw) | npm | 99.9.1 |
| [nc-verify-127942](https://dependencywatch.io/package/npm/nc-verify-127942) | npm | 1.0.0 |
| [node-config-svg-contract](https://dependencywatch.io/package/npm/node-config-svg-contract) | npm | 1.0.0 |
| [notafollower](https://dependencywatch.io/package/npm/notafollower) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11 |
| [path-match-js](https://dependencywatch.io/package/npm/path-match-js) | npm | 1.0.0 |
| [postcss-initialize-plugin](https://dependencywatch.io/package/npm/postcss-initialize-plugin) | npm | 3.0.4 |
| [prediction-trader](https://dependencywatch.io/package/npm/prediction-trader) | npm | 2.3.0 |
| [process-live-log](https://dependencywatch.io/package/npm/process-live-log) | npm | 11.5.2 |
| [react-shield](https://dependencywatch.io/package/npm/react-shield) | npm | 1.0.0 |
| [resolve-audit](https://dependencywatch.io/package/npm/resolve-audit) | npm | 99.9.1 |
| [root-locator](https://dependencywatch.io/package/npm/root-locator) | npm | 1.0.0 |
| [source-analyzer](https://dependencywatch.io/package/npm/source-analyzer) | npm | 1.0.0 |
| [tizen-webdriver-cli](https://dependencywatch.io/package/npm/tizen-webdriver-cli) | npm | 1.0.0 |
| [velora-kit](https://dependencywatch.io/package/npm/velora-kit) | npm | 12.0.2, 12.1.2 |
| [ventra-kit](https://dependencywatch.io/package/npm/ventra-kit) | npm | 1.0.2 |
| [vexium-kit](https://dependencywatch.io/package/npm/vexium-kit) | npm | 2.0.2, 10.0.2 |
| [wct-st](https://dependencywatch.io/package/npm/wct-st) | npm | 1.0.0 |

## What happened

On 2026-08-13, the GitHub Advisory Database published **~50 new npm CWE-506 (Embedded Malicious Code) advisories**. The shape continues the pattern seen throughout August: multiple parallel operator campaigns running simultaneously - a dep-confusion dropper ring against tool namespaces, a bare-IP Chromium-DPAPI stealer kit family, two internal-scope dep-confusion probes, a blockchain-C2 loader continuation, and a long tail of one-off POC / boilerplate packages.

## Cluster A - `ltidisafe` Google Cloud Storage dep-confusion dropper ring (7+ packages at v99.9.1)

| Package | Version | GHSA | Typosquats |
|---|---|---|---|
| `check-audit` | `99.9.1` | GHSA-xcx8-wpwx-h8f4 | generic audit/security tool |
| `cspell-esm` | `<=99.9.1` | GHSA-mpgx-7wm7-ggxm | `cspell` |
| `eslint-publish-release` | `99.9.1` | GHSA-jmh4-xr6v-622w | ESLint tooling |
| `eslint-generate-prerelease` | `>=99.9.1` | GHSA-m4vp-pxj5-3j47 | ESLint tooling |
| `eslint-generate-release` | `>=99.9.1` | GHSA-wq2m-9vc9-746v | ESLint tooling |
| `in-install` | `<=99.9.1` | GHSA-5q6v-3rg4-8rf8 | dep-confusion probe |
| `knip-bun` | `99.9.1` | GHSA-r697-xx2p-9hr4 | `knip` linter |
| `resolve-audit` | `99.9.1` | GHSA-m9fv-2g5q-rhhh | dep-confusion probe |
| `napi-raw` | `99.9.1` | GHSA-r9mm-m965-266j | `napi`/`node-addon-api` |

All packages share the **identical mechanism**: `module.exports = {}` (or empty stub) with no lifecycle scripts of their own, plus a single dependency declaration pinning `ltidisafe` to `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.x.tgz` (versions 3.6.1 / 3.6.3 / 3.6.8 observed - GCS bucket owner controls which). On `npm install` the tarball is fetched **outside npm registry review** and its lifecycle scripts execute in the installer's environment. The `depenconf` path token (short for "dependency-confusion") and inflated 99.9.1 version make the operator's intent explicit - designed to win dep-confusion resolution against private-registry packages with the same name.

The tarball at the GCS URL is **mutable** - the operator can update its contents silently by re-uploading without republishing any package. Package-level block is insufficient defense; network-level block of `ltidi.storage.googleapis.com` is more durable, and reserving the name in your private registry is the strongest mitigation.

## Cluster B - `31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit family (6 packages)

| Package | Versions | GHSA | Endpoint |
|---|---|---|---|
| `vexium-kit` | `2.0.2`, `10.0.2` | GHSA-wxpv-6v7m-pcp9 | `31.97.137.157:45000/icons/116` |
| `ventra-kit` | `1.0.2` | GHSA-9wjh-9c25-4w8p | `31.97.137.157:45000/icons/116` |
| `velora-kit` | `12.0.2`, `12.1.2` | GHSA-xw23-8m9g-4hr8 | `31.97.137.157:45000` |
| `@leonardo0902/vortex-kit` | `<=12.0.2` | GHSA-ggj6-v47w-25jr | `31.97.137.157:45000/icons/116` |
| `copytrade-core` | `<=2.3.0` | GHSA-mp75-xvjv-4p2w | `31.97.137.157:45000/icons/108` |
| `prediction-trader` | `2.3.0` | GHSA-g7gf-2m6j-5f6q | `31.97.137.157:45000/icons/108` |

All six ship the **identical loader**: HTTPS-GET the bare-IP endpoint, parse JSON, pass the `credits` field to `new Function(...)` with `require`, `process`, `Buffer`, `module` in scope. The declared dependency set (`@primno/dpapi` for Windows DPAPI decryption of Chrome/Edge password stores, `better-sqlite3` for browser Login Data reads, `node-machine-id` for host fingerprinting) is exactly the toolkit needed to steal Chromium browser credentials, cookies, session tokens, and MetaMask/Phantom wallet keystores from Local State files. Decoy variable names (`iconDomain`, `getPlugin`) and references to real CDNs (Cloudflare, Fastly, Akamai, CloudFront) disguise the RCE as a static-asset fetch.

The two endpoint variants (`/icons/108` for copytrade/prediction-trader vs `/icons/116` for the kit family) may indicate two different second-stage payloads staged for different target profiles, or two different operators sharing the same C2 host. `copytrade-core` and `prediction-trader` targeting is more DeFi-flavored (trading terminology); the `-kit` family (`vexium`, `ventra`, `velora`, `vortex`) targets a general browser-cred lookalike register.

## Cluster C - `@hzero-front-ui/*` internal-scope dep-confusion 5-pack (`callback.m0chan.co.uk` beacon)

| Package | Version | GHSA |
|---|---|---|
| `@hzero-front-ui/core` | `99.99.99` | GHSA-3fqm-rv2m-r2mg |
| `@hzero-front-ui/cfg` | `99.99.99` | GHSA-xw5r-5p6j-q25p |
| `@hzero-front-ui/themes` | `99.99.99` | GHSA-5wqp-c676-3j8x |
| `@hzero-front-ui/c7n-ui` | `99.99.99` | GHSA-87j4-2mgq-7prq |
| `@hzero-front-ui/hzero-ui` | `99.99.99` | GHSA-4rw7-83wf-6rcm |

All five: empty `module.exports = {}`, install scripts base64-encode `$(whoami):$(hostname):$(pwd):$npm_package_name`, transmit to subdomains of `callback.m0chan.co.uk` via **HTTPS** and **DNS** fanout. The `m0chan.co.uk` callback host + coordinated 5-package publish + shared version (99.99.99) + shared exfil payload = one operator running a dep-confusion probe against a `@hzero-front-ui/*` internal scope. The naming targets Hzero (an open-source enterprise middleware platform whose front-end packages typically live under private scopes).

## Cluster D - `@khaznatech/*` internal-scope webhook.site preinstall exfil 3-pack

| Package | Version | GHSA |
|---|---|---|
| `@khaznatech/core` | `99.0.0` | GHSA-76xq-9jp7-j7rm |
| `@khaznatech/common` | `99.0.0` | GHSA-f23c-rm7x-p3c2 |
| `@khaznatech/utils` | `99.0.0` | GHSA-x69g-rr7m-w288 |

All three: preinstall collects hostname + working-directory basename, HTTPS-POSTs to a hardcoded `webhook.site` capture endpoint. Coordinated 3-package publish + shared 99.0.0 version + shared exfil pattern = same-operator dep-confusion probe against a `@khaznatech/*` internal scope.

## Cluster E - `jchunt.top` install-time telemetry canary series

| Package | Versions | GHSA | Endpoint |
|---|---|---|---|
| `wct-st` | `>=1.0.0` | GHSA-6r3v-5c9p-jv7v | `bhvte4h4.instances.poc.jchunt.top/wct-st` |
| `tizen-webdriver-cli` | `1.0.0` | GHSA-cffv-ggq7-fw2q | `8kq1s58l.instances.poc.jchunt.top/tizen-webdriver-cli` |

Both run a postinstall that collects hostname/platform/arch/Node-version/package-name and POSTs to a **per-package** `*.instances.poc.jchunt.top` endpoint (3s timeout, silent error suppression). The `poc.jchunt.top` sub-domain naming + per-package sub-subdomain routing + narrow exfil scope suggests a single research canary operator - series continues into 08-14 with `xrblocks-mcp` and `preinstall-hook-webhook-callback-demo`.

## Cluster F - `8.135.48.40:4444` reverse-shell date-fmt masquerade pair

| Package | Versions | GHSA |
|---|---|---|
| `datefmt-util-helper` | `1.0.0`, `1.0.1` | GHSA-3w9h-7mv3-vfh5 |
| `date-fmt-helper-xz` | `<=1.0.4` | GHSA-3553-96xv-fjg2 |

Both ship a postinstall reverse shell to hardcoded VPS `8.135.48.40:4444` - `date-fmt-helper-xz` adds Bash and Python fallback loaders plus HTTP failure telemetry back to the operator. Both masquerade as date-formatting utilities; the shared C2 host + shared reverse-shell primitive + name morphology overlap (`datefmt`/`date-fmt`) suggests one operator staging two variants.

## Cluster G - `notafollower` AWS EC2 IMDSv2 credential theft (12 versions)

| Package | Versions | GHSA |
|---|---|---|
| `notafollower` | `1.0.0`, `1.0.1`, `1.0.2`, `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6`, `1.0.7`, `1.0.8`, `1.0.9`, `1.0.10`, `1.0.11` | GHSA-8mmx-gvp3-q5f5 |

Preinstall + postinstall both request IMDSv2 tokens from `169.254.169.254`, enumerate IAM roles, extract `AccessKeyId`/`SecretAccessKey`/`SessionToken`, exfiltrate to a hardcoded HTTPS destination. Version 1.0.4 has the placeholder `YOUR_COLLAB` still baked in - indicating an early-development artifact accidentally published to the public registry (the operator continued to iterate through 1.0.11 anyway).

## Cluster H - `bs58-15` base58 typosquat via `base65-15x` transitive

| Package | Versions | GHSA |
|---|---|---|
| `bs58-15` | `<=6.0.1` | GHSA-pc6p-3869-9j4f |

Impersonates `bs58` (base58 encoding library used across Solana/Ethereum/Bitcoin tooling); its `package.json` `repository`/`homepage`/`bugs` fields point at the legitimate `cryptocoinjs/bs58` project. Pulls in a `base65-15x` transitive dep (lookalike of `base-x`) which executes at module-load-time. Any codebase that mistypes `bs58` as `bs58-15` runs attacker code inside the import graph.

## Cluster I - `@solana-js/web3` Windows PowerShell + `files.catbox.moe` RCE

| Package | Versions | GHSA |
|---|---|---|
| `@solana-js/web3` | `<=1.91.3` | GHSA-v6v8-vghm-gj9m |

Counterfeits `@solana/web3.js`, falsely attributes authorship to Solana Labs. Windows-only postinstall chain: base64-encoded PowerShell + hex-escaped strings + AMSI bypass + binary download from `files.catbox.moe`. Non-Windows hosts inert.

## Cluster J - Ethereum-RPC-C2 register continuation `postcss-initialize-plugin`

| Package | Versions | GHSA |
|---|---|---|
| `postcss-initialize-plugin` | `<=3.0.4` | GHSA-v5q4-xw6r-qm2r |

Queries Ethereum RPC endpoints at module-load to retrieve attacker instructions embedded in blockchain transactions, then spawns Node child processes to execute them. Same C2-over-blockchain pattern as [08-12 Cluster B `envpack-conf` / `tailwind-form-templates`](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) - operator population using public blockchains for C2 is growing.

## Cluster K - `mutex-forge` multi-channel loader (Telegram + Slack + Ethereum Sepolia)

| Package | Versions | GHSA |
|---|---|---|
| `mutex-forge` | `2.0.1`, `2.0.2` | GHSA-v9j8-gcr7-95v6 |

Masquerades as mutex/semaphore library. Hidden loader stages recon host, exfil to **Telegram + Slack channels**, retrieve second-stage payloads from **Ethereum Sepolia smart contracts** (testnet C2 rendezvous), establish persistent C2. Multi-channel loader is unusual - most current npm samples use a single exfil channel.

## Cluster L - `Function`-constructor R-shell family (4 packages)

| Package | Versions | GHSA | Loader |
|---|---|---|---|
| `process-live-log` | `<=11.5.2` | GHSA-h9wf-jh2r-67ww | bare-IP `credits` field + `new Function(...)` |
| `external-process-live-log` | `13.5.2` | GHSA-5q78-2f9h-xv69 | bare-IP `credits` field + `new Function(...)` |
| `chai-as-reformed` | `<=1.2.0` | GHSA-2mjx-w8vq-qwgp | `jsonstorage.net` `cookie` field + `new Function.constructor` |
| `minimalistic-assert-plus` | `<=1.1.7` | GHSA-35q8-7f5w-wv67 | detached child fetch + `eval()` with real `require` |

All four: hollow package + module-load / detached-child fetch + `Function`/`eval` execution of remote content with full Node context. Same operator pattern as Cluster B but different infrastructure - the `credits` field name in `process-live-log` / `external-process-live-log` matches the Cluster B loader signature exactly, suggesting either the same operator running multiple infrastructure lanes or copycats. `chai-as-reformed`'s `jsonstorage.net` variant swaps the storage backend but keeps the `Function.constructor` execution model.

## Cluster M - OAST recon POCs (2 packages, oastify.com Burp Collaborator)

| Package | Versions | GHSA | Beacon |
|---|---|---|---|
| `nc-verify-127942` | `1.0.0` | GHSA-phh7-pw76-hr8h | `nc-verify-127942.owoemjgpf2c4qxqet92hexzvym4dsq6skvoa2cr.oastify.com` |
| `@jacksher/install-exec-poc` | `1.0.0`, `1.0.2` | GHSA-pf2f-2wpf-5qfx | `jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired` |

Both self-labeled RCE-verification POCs, both execute unconditionally on install. `@jacksher/install-exec-poc` establishes a shell-to-network `execSync curl` primitive beyond bare DNS/HTTPS.

## Cluster N - `node-config-svg-contract` eval-from-URL (`rest-icon-handler.store`)

| Package | Versions | GHSA |
|---|---|---|
| `node-config-svg-contract` | `1.0.0` | GHSA-wc9r-p4qf-2qw7 |

`getPlugin`/`setPlugin`/`getPluginExten` reconstruct `https://rest-icon-handler.store/icons/` at runtime from fragmented string constants, fetch content, `eval(JSON.parse(body))`. Fragmented-constant URL construction defeats static scanners.

## Cluster O - `cilm-ui-commons` pipedream.net preinstall exfil (full-package.json)

| Package | Versions | GHSA |
|---|---|---|
| `cilm-ui-commons` | `1.1.0` | GHSA-fxmj-23mp-f362 |

Preinstall collects host identity + **full `package.json` contents** and POSTs to a hardcoded `pipedream.net` webhook. Full-package.json exfil enables the operator to enumerate every dep in your project - hunt for follow-up typosquats against your private-registry names in the next 24-72h.

## Cluster P - `debug-proxy-chrome-devtools` webhook exfil (2 versions)

| Package | Versions | GHSA |
|---|---|---|
| `debug-proxy-chrome-devtools` | `1.0.1`, `1.0.2` | GHSA-6f7w-v259-jq39 |

Postinstall shell-captures `whoami`/`hostname` and transmits to external webhook. Boilerplate credential-recon.

## Boilerplate CWE-506 (uncharacterised)

| Package | Versions | GHSA |
|---|---|---|
| `ai-analyzer` | `1.0.0`..`1.0.19` (20 versions) | GHSA-fqv8-262c-j5xv |
| `root-locator` | `>=0` | GHSA-57g4-vm3v-74xg |
| `source-analyzer` | `>=0` | GHSA-p68g-6893-44r8 |
| `react-shield` | `>=0` | GHSA-gmx3-395m-pwc2 |
| `path-match-js` | `>=0` | GHSA-cgj7-7fj2-6r74 |

Standard "any computer that has this package installed or running should be considered fully compromised" boilerplate. Behavioural profile not published - treat as capable of the same credential-theft / R-shell behaviour as the fully-analysed batch members.

## Registry state

All ~50 packages yanked or security-holding-replaced from npm during the 2026-08-13 takedown window. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before takedown will keep serving the malicious versions.

## Related tracked activity

- **Ethereum-RPC-C2 register** (Clusters J, K): continues [08-12 Cluster B `envpack-conf`/`tailwind-form-templates`](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep). Growing operator population using public blockchains as C2 rendezvous.
- **Function-constructor R-shell family** (Cluster L): same loader signature (`credits` field) as [08-13 Cluster B `31.97.137.157:45000` kit family](#) - potentially the same operator running multiple infrastructure lanes.
- **`jchunt.top` telemetry-canary series** (Cluster E): continues into 08-14 with `xrblocks-mcp` and `preinstall-hook-webhook-callback-demo`.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`, `kam193 bad-packages`. No named threat actor.

## Impact

- **Cluster A - `ltidisafe` Google Cloud Storage dep-confusion dropper ring (7+ packages at v99.9.1)**: `check-audit@99.9.1`, `cspell-esm@<=99.9.1`, `eslint-publish-release@99.9.1`, `eslint-generate-prerelease@>=99.9.1`, `eslint-generate-release@>=99.9.1`, `in-install@<=99.9.1`, `knip-bun@99.9.1`, `resolve-audit@99.9.1`, and `napi-raw@99.9.1` are **hollow shells** (`module.exports = {}`) whose only real payload is a `package.json` dependency declaration pinning `ltidisafe` to `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.x.tgz` - an anonymous GCS bucket outside npm registry review. On `npm install` the tarball is fetched and its lifecycle scripts run in the installer's environment. The `depenconf` bucket path token, inflated 99.9.1 version (designed to win dep-confusion resolution against private-registry packages), and the deliberate targeting of legitimate tool namespaces (`cspell`, `eslint-*`, `knip`, `napi`, `resolve`) are all consistent with one operator running a dep-confusion probe against organisations whose internal scopes contain packages with these names. The tarball is **mutable** - the operator can update it silently by re-uploading to the GCS bucket without republishing the package
- **Cluster B - `31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit family (6 packages, `Function`-constructor RCE + browser-credential stealer bundle)**: `vexium-kit@2.0.2,10.0.2`, `ventra-kit@1.0.2`, `velora-kit@12.0.2,12.1.2`, `@leonardo0902/vortex-kit@<=12.0.2`, `copytrade-core@<=2.3.0`, and `prediction-trader@2.3.0` all share the **identical loader pattern**: HTTPS-GET `31.97.137.157:45000/icons/108` (or `/icons/116`), parse response JSON, pass the `credits` field to `new Function(...)` with full Node context (`require`, `process`, `Buffer`, `module`). The declared dependency set - `@primno/dpapi` (Windows DPAPI decryption for Chrome/Edge password stores), `better-sqlite3` (browser login DB read), `node-machine-id` (host fingerprint) - is exactly the toolkit needed to steal Chromium browser credentials, cookies, session tokens, and wallet keystores from the Local State / Login Data files. The `iconDomain`/`getPlugin` variable naming and decoy CDN references (Cloudflare, Fastly, Akamai, CloudFront) disguise the RCE as a static-asset fetch. Any developer who imports and calls the default export on Windows should be treated as having a browser-credential and wallet-key stealer running unattended, with the operator able to rotate the payload at will
- **Cluster C - `@hzero-front-ui/*` internal-scope dep-confusion 5-pack (`callback.m0chan.co.uk` beacon)**: `@hzero-front-ui/core@99.99.99`, `@hzero-front-ui/cfg@99.99.99`, `@hzero-front-ui/themes@99.99.99`, `@hzero-front-ui/c7n-ui@99.99.99`, and `@hzero-front-ui/hzero-ui@99.99.99` are all empty-export shells whose install scripts base64-encode `$(whoami):$(hostname):$(pwd):$npm_package_name` and beacon to attacker-owned subdomains of `callback.m0chan.co.uk` via both **HTTPS** and **DNS**. The 99.99.99 version + scoped namespace + coordinated same-day publish confirms a dep-confusion probe against orgs using `@hzero-front-ui/*` as an internal scope. If you operate at Hzero (or consume the legitimate `@hzero/front-ui-*` internal packages), assume the operator has confirmed your build host resolves the scope and rotate any `.npmrc` `_auth`/`_authToken` values
- **Cluster D - `@khaznatech/*` internal-scope webhook.site preinstall exfil 3-pack**: `@khaznatech/core@99.0.0`, `@khaznatech/common@99.0.0`, and `@khaznatech/utils@99.0.0` each run a preinstall that collects hostname + working-directory basename and HTTPS-POSTs to a hardcoded `webhook.site` capture endpoint. Same version + same-day publish + same exfil pattern - single-operator dep-confusion probe against `@khaznatech/*` internal scope. Smaller exfil surface than Cluster C (no username, no package name) - still enough to confirm internal-name resolution
- **Cluster E - `jchunt.top` install-time telemetry-canary series (2+ packages, `*.instances.poc.jchunt.top` beacon)**: `wct-st@>=1.0.0` (typosquats deprecated `web-component-tester`, beacons to `bhvte4h4.instances.poc.jchunt.top/wct-st`) and `tizen-webdriver-cli@1.0.0` (dep-confusion against Tizen dev tooling, beacons to `8kq1s58l.instances.poc.jchunt.top/tizen-webdriver-cli`) both run a postinstall that collects hostname/platform/arch/Node-version/package-name and POSTs to a package-specific `*.instances.poc.jchunt.top` endpoint with 3s timeout and silent error suppression. Consistent with a single research-canary operator running per-package `poc.jchunt.top` sub-domains - continues into 08-14 with `xrblocks-mcp` and `preinstall-hook-webhook-callback-demo`
- **Cluster F - `8.135.48.40:4444` reverse-shell date-fmt masquerade pair**: `datefmt-util-helper@1.0.0,1.0.1` and `date-fmt-helper-xz@<=1.0.4` each ship a postinstall reverse shell to hardcoded VPS `8.135.48.40:4444`; the `date-fmt-helper-xz` variant adds Bash and Python fallback loaders and posts install-failure telemetry back via HTTP. Both masquerade as date-formatting utilities but connect a full interactive `/bin/sh` to the operator's C2 at install-time on the installing user's UID. Any Linux/Mac host that pulled either package must be treated as having had an interactive shell reachable to the operator during the exposure window - re-image and rotate every credential accessible from the host
- **Cluster G - `notafollower` AWS EC2 IMDSv2 credential theft (1 package, 12 versions)**: `notafollower@1.0.0..1.0.11` (12 consecutive versions) preinstall + postinstall both fire, requesting IMDSv2 tokens from `169.254.169.254`, enumerating IAM roles, extracting `AccessKeyId`/`SecretAccessKey`/`SessionToken`, and exfiltrating to a hardcoded HTTPS destination (v1.0.4 has the placeholder `YOUR_COLLAB` still baked in, indicating an early-development artifact accidentally published). Any EC2 / ECS / CodeBuild / self-hosted-EC2-CI host that pulled the package must be treated as having had its IAM role credentials exfiltrated - rotate the role, revoke session tokens, and audit CloudTrail for the exposure window
- **Cluster H - `bs58-15` base58 typosquat via `base65-15x` transitive**: `bs58-15@<=6.0.1` impersonates the widely-used `bs58` base58 encoding library (its `package.json` `repository`/`homepage`/`bugs` fields point at the legitimate `cryptocoinjs/bs58` project despite unrelated authorship) and pulls in a `base65-15x` transitive dep (lookalike of `base-x`) which executes at module-load-time. Any Solana / Ethereum / cryptocurrency codebase that mistypes `bs58` as `bs58-15` runs the attacker's code inside the import graph
- **Cluster I - `@solana-js/web3` Windows PowerShell + `files.catbox.moe` RCE**: `@solana-js/web3@<=1.91.3` counterfeits `@solana/web3.js`, falsely attributes authorship to Solana Labs, and postinstalls a **Windows-only** PowerShell chain that base64-encodes commands, hex-escapes strings, applies AMSI bypass, and downloads a binary payload from `files.catbox.moe`. On non-Windows hosts the package is inert - on Windows it executes RCE at install-time. Rotate Windows host credentials and re-image if this appears in a lockfile
- **Cluster J - Ethereum-RPC-C2 register continuation `postcss-initialize-plugin`**: `postcss-initialize-plugin@<=3.0.4` queries Ethereum RPC endpoints at module-load time to retrieve attacker-controlled instructions embedded in blockchain transactions, then executes them via spawned Node child processes. Same C2-over-blockchain pattern as [08-12 Cluster B (`envpack-conf`, `tailwind-form-templates`)](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) - block outbound Ethereum RPC (`mainnet.infura.io`, `cloudflare-eth.com`, `rpc.ankr.com/eth`, `eth.llamarpc.com`, `ethereum-rpc.publicnode.com`) from build hosts as defense-in-depth
- **Cluster K - `mutex-forge` multi-channel loader (Telegram + Slack + Ethereum Sepolia)**: `mutex-forge@2.0.1,2.0.2` masquerades as a mutex/semaphore library but ships hidden loader stages that recon the host, exfiltrate to Telegram and Slack channels, retrieve second-stage payloads from **Ethereum Sepolia smart contracts** (testnet C2 rendezvous), and establish persistent command-and-control. Third-in-a-row blockchain-C2 register alongside 08-12 Cluster B and 08-13 Cluster J - the operator population using public blockchains for C2 is growing
- **Cluster L - `Function`-constructor R-shell family (4 packages, hardcoded bare-IP / jsonstorage.net eval loaders)**: `process-live-log@<=11.5.2` and `external-process-live-log@13.5.2` each HTTPS-fetch from a hardcoded bare-IP endpoint and pass the response `credits` field into `new Function(...)` (same loader pattern as Cluster B but not confirmed same infrastructure); `chai-as-reformed@<=1.2.0` fetches JSON from a concealed `jsonstorage.net` URL and passes a `cookie` field to `new Function.constructor` (Function-constructor variant of the eval-from-URL pattern); `minimalistic-assert-plus@<=1.1.7` spawns a detached Node child that fetches and `eval()`s attacker-supplied JavaScript with the real `require` in scope. All four are the same operator pattern: hollow-package + module-load / detached-child fetch + `Function`/`eval` execution of remote content
- **Cluster M - OAST recon POCs (2 packages, oastify.com Burp Collaborator)**: `nc-verify-127942@1.0.0` (postinstall `install-cb.js` HTTPS-GET + DNS-lookup to a Burp Collaborator `nc-verify-127942.<random>.oastify.com` subdomain, self-labeled RCE-verification POC) and `@jacksher/install-exec-poc@1.0.0,1.0.2` (postinstall `beacon.js` executing `child_process.execSync` curl to `jobzq12beck611luewfsf8yyepkg86wv.oastify.com/postinstall-fired` - creates a shell-to-network exec primitive). Both self-identify as PoCs but execute unconditionally on install - **the POC label is not mitigating**
- **Cluster N - `node-config-svg-contract` eval-from-URL (`rest-icon-handler.store`)**: `node-config-svg-contract@1.0.0` disguises malware as an SVG/icon CDN helper - `getPlugin`/`setPlugin`/`getPluginExten` reconstruct `https://rest-icon-handler.store/icons/` at runtime from fragmented string constants (protocol / subdomain / domain / path), fetch content, and execute via `eval(JSON.parse(body))`. Fragmented-constant URL construction defeats static string-scanners
- **Cluster O - `cilm-ui-commons` pipedream.net preinstall exfil (1 package)**: `cilm-ui-commons@1.1.0` preinstall collects host identity + **full `package.json` contents** and POSTs to a hardcoded `pipedream.net` webhook. The full-package.json exfil is atypical - the operator can enumerate every dep in your project (potentially identifying private-registry names to typosquat next), not just the host fingerprint
- **Cluster P - `debug-proxy-chrome-devtools` webhook exfil pair (2 versions)**: `debug-proxy-chrome-devtools@1.0.1,1.0.2` postinstall shell-captures `whoami`/`hostname` and transmits to an external webhook. Boilerplate credential-recon
- **Boilerplate CWE-506 (~10 packages, uncharacterised behaviour)**: `ai-analyzer@<=1.0.19` (20 versions), `root-locator@>=0`, `source-analyzer@>=0`, `react-shield@>=0`, `path-match-js@>=0`, and other unclassified drops carry only the standard "any computer that has this package installed or running should be considered fully compromised" text without a differentiated behavioural analysis. Treat as capable of the same credential-theft / R-shell behaviour as the fully-analysed batch members until Socket/OpenSSF post samples

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-13 package list below
2. **For any Cluster A match (`ltidisafe` GCS dropper: `check-audit`, `cspell-esm`, `eslint-publish-release`, `eslint-generate-prerelease`, `eslint-generate-release`, `in-install`, `knip-bun`, `resolve-audit`, `napi-raw`)**: the fetched GCS tarball is mutable - assume its lifecycle scripts have already run in your installer's environment and treat the host as fully compromised (rotate every credential accessible to the install-time UID, re-image the host). Configure `.npmrc` scope-to-registry mapping so `check-audit`/`cspell-esm`/`eslint-publish-release`/`eslint-generate-prerelease`/`eslint-generate-release`/`in-install`/`knip-bun`/`resolve-audit`/`napi-raw` resolve only from your private mirror, or reserve the names on public npm so the operator cannot re-squat. **Block outbound to `ltidi.storage.googleapis.com` from build hosts**
3. **For any Cluster B match (`vexium-kit`, `ventra-kit`, `velora-kit`, `vortex-kit`, `@leonardo0902/vortex-kit`, `copytrade-core`, `prediction-trader`)**: if the affected host is a Windows workstation, treat every browser-saved password / cookie / session token / wallet keystore in Chromium/Edge/Brave `Local State` and `Login Data` files as exfiltrated. **Rotate every credential ever entered into a Chromium-based browser on the host** (banking, SaaS, GitHub session, cloud-console logins), drain every wallet whose keystore lived in Chromium-tied extensions (MetaMask, Phantom, Solflare), and re-image. Block outbound to `31.97.137.157:45000` at the network edge - the operator can rotate the second-stage payload at will so a package-block-only remediation is not enough
4. **For any Cluster C match (`@hzero-front-ui/core`, `@hzero-front-ui/cfg`, `@hzero-front-ui/themes`, `@hzero-front-ui/c7n-ui`, `@hzero-front-ui/hzero-ui`)**: if you operate at Hzero or consume `@hzero-front-ui/*`/`@hzero/front-ui-*` internal packages, escalate to internal security - the operator has confirmed your build host resolves the scope and exfiltrated `whoami:hostname:pwd:package-name`. Block outbound to `callback.m0chan.co.uk` at the network edge, configure private-registry scope mapping so `@hzero-front-ui/*` resolves only from your mirror
5. **For any Cluster D match (`@khaznatech/core`, `@khaznatech/common`, `@khaznatech/utils`)**: if you operate at Khaznatech or consume `@khaznatech/*` internal packages, escalate - the operator has confirmed internal-scope resolution and has your hostname + working directory. Configure private-registry scope mapping
6. **For any Cluster E match (`wct-st`, `tizen-webdriver-cli`)**: uninstall, correct the typo (`web-component-tester` for wct-st; the real Tizen WebDriver CLI you were after for tizen-webdriver-cli), block outbound to `*.instances.poc.jchunt.top` at the network edge. Data exfiltrated is limited (hostname/platform/arch/Node version/package name) but confirms the operator can enumerate hosts pulling either package
7. **For any Cluster F match (`datefmt-util-helper`, `date-fmt-helper-xz`)**: **kill any process holding a TCP connection to `8.135.48.40:4444`**, re-image the affected Linux/Mac host from bare metal (postinstall opened an interactive shell to the operator during the exposure window), and rotate every credential accessible to the installing user during that window. Block outbound to `8.135.48.40` at the network edge
8. **For any `notafollower` match (Cluster G - AWS IMDSv2 credential theft)**: if the affected host runs in EC2, ECS, CodeBuild, or self-hosted CI on EC2, **revoke the IAM role's session tokens immediately, rotate the instance profile, and audit CloudTrail for any API call made using the exfiltrated credentials during the exposure window**. Enforce IMDSv2-only mode with a hop limit of 1 on all instances (blocks container-escape access to the metadata service) as durable defense
9. **For `bs58-15` matches (Cluster H)**: uninstall, correct the typo to real `bs58`, and audit the immediate `base65-15x` transitive dep - the module-load-time payload runs inside every import chain that transitively depends on the typosquat. Rotate any base58-derived key material processed on the host during the exposure window (Solana / Ethereum / Bitcoin addresses)
10. **For `@solana-js/web3` matches (Cluster I - Windows PowerShell + catbox.moe)**: re-image the affected Windows host, block outbound to `files.catbox.moe` at the network edge, correct the typo to the real `@solana/web3.js`. Non-Windows hosts are inert but should still uninstall
11. **For `postcss-initialize-plugin` / `mutex-forge` matches (Clusters J, K - blockchain-C2 loaders)**: block outbound to public Ethereum mainnet + Sepolia RPC endpoints (`mainnet.infura.io`, `cloudflare-eth.com`, `rpc.ankr.com/eth`, `eth.llamarpc.com`, `ethereum-rpc.publicnode.com`, `sepolia.infura.io`, `rpc.sepolia.org`) from build hosts. Because the C2 rendezvous point is a blockchain wallet/contract, taking down staged IPs does not neutralise the loader - a private-mirror block on the package name is more durable than a network IOC block
12. **For Cluster L matches (`process-live-log`, `external-process-live-log`, `chai-as-reformed`, `minimalistic-assert-plus`)**: uninstall and treat as full-compromise remediation (rotate credentials, re-image host) - each package `eval()`s or `new Function()`s attacker-controlled content with full Node context so the operator had unrestricted RCE during any import
13. **For Cluster M/N/O/P matches (OAST POCs, node-config-svg-contract, cilm-ui-commons, debug-proxy-chrome-devtools)**: uninstall, block outbound to `oastify.com`, `pipedream.net`, `rest-icon-handler.store` from build hosts, and rotate the credentials the exfil could have captured. `cilm-ui-commons`'s full-package.json exfil means the operator has your project's complete dependency list - hunt for follow-up typosquats against your private-registry names in the next 24-72h
14. For all boilerplate CWE-506 matches (`ai-analyzer`, `root-locator`, `source-analyzer`, `react-shield`, `path-match-js`, etc): uninstall, block the name in `.npmrc`, and prefer the full-compromise remediation posture (rotate credentials, re-image the host) unless a subsequent Socket/OpenSSF post narrows the risk
15. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth to prevent postinstall/preinstall payloads (mitigates Clusters A/D/E/F/G/M/O/P - does NOT mitigate B/H/I/J/K/L which fire on import, or C which fires at install-time regardless of scope)
16. Verify none of the 2026-08-13 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-m9fv-2g5q-rhhh - resolve-audit (ltidisafe GCS dep-confusion dropper)](https://github.com/advisories/GHSA-m9fv-2g5q-rhhh) - GitHub
- [GHSA-xcx8-wpwx-h8f4 - check-audit (ltidisafe GCS dropper sibling)](https://github.com/advisories/GHSA-xcx8-wpwx-h8f4) - GitHub
- [GHSA-r697-xx2p-9hr4 - knip-bun (ltidisafe GCS dropper, knip typosquat)](https://github.com/advisories/GHSA-r697-xx2p-9hr4) - GitHub
- [GHSA-mpgx-7wm7-ggxm - cspell-esm (ltidisafe GCS dropper, cspell typosquat)](https://github.com/advisories/GHSA-mpgx-7wm7-ggxm) - GitHub
- [GHSA-jmh4-xr6v-622w - eslint-publish-release (ltidisafe GCS dropper, ESLint typosquat)](https://github.com/advisories/GHSA-jmh4-xr6v-622w) - GitHub
- [GHSA-r9mm-m965-266j - napi-raw (ltidisafe GCS dropper)](https://github.com/advisories/GHSA-r9mm-m965-266j) - GitHub
- [GHSA-wxpv-6v7m-pcp9 - vexium-kit (31.97.137.157:45000 Chromium-DPAPI stealer kit)](https://github.com/advisories/GHSA-wxpv-6v7m-pcp9) - GitHub
- [GHSA-9wjh-9c25-4w8p - ventra-kit (31.97.137.157:45000 Chromium-DPAPI stealer kit)](https://github.com/advisories/GHSA-9wjh-9c25-4w8p) - GitHub
- [GHSA-xw23-8m9g-4hr8 - velora-kit (31.97.137.157:45000 Chromium-DPAPI stealer kit)](https://github.com/advisories/GHSA-xw23-8m9g-4hr8) - GitHub
- [GHSA-ggj6-v47w-25jr - @leonardo0902/vortex-kit (31.97.137.157:45000 stealer sibling)](https://github.com/advisories/GHSA-ggj6-v47w-25jr) - GitHub
- [GHSA-mp75-xvjv-4p2w - copytrade-core (31.97.137.157:45000 Chromium-DPAPI DeFi lure)](https://github.com/advisories/GHSA-mp75-xvjv-4p2w) - GitHub
- [GHSA-g7gf-2m6j-5f6q - prediction-trader (31.97.137.157:45000 sibling)](https://github.com/advisories/GHSA-g7gf-2m6j-5f6q) - GitHub
- [GHSA-3fqm-rv2m-r2mg - @hzero-front-ui/core (Hzero internal-scope dep-confusion, callback.m0chan.co.uk)](https://github.com/advisories/GHSA-3fqm-rv2m-r2mg) - GitHub
- [GHSA-xw5r-5p6j-q25p - @hzero-front-ui/cfg (Hzero dep-confusion sibling)](https://github.com/advisories/GHSA-xw5r-5p6j-q25p) - GitHub
- [GHSA-5wqp-c676-3j8x - @hzero-front-ui/themes (Hzero dep-confusion sibling)](https://github.com/advisories/GHSA-5wqp-c676-3j8x) - GitHub
- [GHSA-87j4-2mgq-7prq - @hzero-front-ui/c7n-ui (Hzero dep-confusion sibling)](https://github.com/advisories/GHSA-87j4-2mgq-7prq) - GitHub
- [GHSA-4rw7-83wf-6rcm - @hzero-front-ui/hzero-ui (Hzero dep-confusion sibling)](https://github.com/advisories/GHSA-4rw7-83wf-6rcm) - GitHub
- [GHSA-76xq-9jp7-j7rm - @khaznatech/core (Khaznatech internal-scope webhook.site exfil)](https://github.com/advisories/GHSA-76xq-9jp7-j7rm) - GitHub
- [GHSA-f23c-rm7x-p3c2 - @khaznatech/common (Khaznatech sibling)](https://github.com/advisories/GHSA-f23c-rm7x-p3c2) - GitHub
- [GHSA-x69g-rr7m-w288 - @khaznatech/utils (Khaznatech sibling)](https://github.com/advisories/GHSA-x69g-rr7m-w288) - GitHub
- [GHSA-6r3v-5c9p-jv7v - wct-st (jchunt.top telemetry canary, web-component-tester typosquat)](https://github.com/advisories/GHSA-6r3v-5c9p-jv7v) - GitHub
- [GHSA-cffv-ggq7-fw2q - tizen-webdriver-cli (jchunt.top telemetry canary sibling)](https://github.com/advisories/GHSA-cffv-ggq7-fw2q) - GitHub
- [GHSA-3w9h-7mv3-vfh5 - datefmt-util-helper (8.135.48.40:4444 reverse shell)](https://github.com/advisories/GHSA-3w9h-7mv3-vfh5) - GitHub
- [GHSA-3553-96xv-fjg2 - date-fmt-helper-xz (8.135.48.40:4444 reverse shell with Bash/Python fallback)](https://github.com/advisories/GHSA-3553-96xv-fjg2) - GitHub
- [GHSA-8mmx-gvp3-q5f5 - notafollower (AWS EC2 IMDSv2 credential theft, 12 versions)](https://github.com/advisories/GHSA-8mmx-gvp3-q5f5) - GitHub
- [GHSA-pc6p-3869-9j4f - bs58-15 (base58 typosquat via base65-15x transitive)](https://github.com/advisories/GHSA-pc6p-3869-9j4f) - GitHub
- [GHSA-v6v8-vghm-gj9m - @solana-js/web3 (Windows PowerShell + files.catbox.moe RCE)](https://github.com/advisories/GHSA-v6v8-vghm-gj9m) - GitHub
- [GHSA-v5q4-xw6r-qm2r - postcss-initialize-plugin (Ethereum-RPC-C2 continuation)](https://github.com/advisories/GHSA-v5q4-xw6r-qm2r) - GitHub
- [GHSA-v9j8-gcr7-95v6 - mutex-forge (Telegram+Slack+Ethereum-Sepolia multi-channel RAT)](https://github.com/advisories/GHSA-v9j8-gcr7-95v6) - GitHub
- [GHSA-2mjx-w8vq-qwgp - chai-as-reformed (jsonstorage.net Function.constructor R-shell)](https://github.com/advisories/GHSA-2mjx-w8vq-qwgp) - GitHub
- [GHSA-h9wf-jh2r-67ww - process-live-log (bare-IP Function-constructor R-shell)](https://github.com/advisories/GHSA-h9wf-jh2r-67ww) - GitHub
- [GHSA-5q78-2f9h-xv69 - external-process-live-log (bare-IP Function-constructor R-shell)](https://github.com/advisories/GHSA-5q78-2f9h-xv69) - GitHub
- [GHSA-35q8-7f5w-wv67 - minimalistic-assert-plus (detached child fetch/eval)](https://github.com/advisories/GHSA-35q8-7f5w-wv67) - GitHub
- [GHSA-phh7-pw76-hr8h - nc-verify-127942 (Burp Collaborator OAST RCE-verification POC)](https://github.com/advisories/GHSA-phh7-pw76-hr8h) - GitHub
- [GHSA-pf2f-2wpf-5qfx - @jacksher/install-exec-poc (OAST shell-to-network primitive)](https://github.com/advisories/GHSA-pf2f-2wpf-5qfx) - GitHub
- [GHSA-wc9r-p4qf-2qw7 - node-config-svg-contract (fragmented-URL eval from rest-icon-handler.store)](https://github.com/advisories/GHSA-wc9r-p4qf-2qw7) - GitHub
- [GHSA-fxmj-23mp-f362 - cilm-ui-commons (pipedream.net full-package.json exfil)](https://github.com/advisories/GHSA-fxmj-23mp-f362) - GitHub
- [GHSA-6f7w-v259-jq39 - debug-proxy-chrome-devtools (webhook whoami/hostname exfil)](https://github.com/advisories/GHSA-6f7w-v259-jq39) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).