# GitHub Advisory npm CWE-506 sweep - 2026-08-14 batch (~27 packages: `jchunt.top` telemetry-canary day-2 `xrblocks-mcp`, `preinstall-hook-webhook-callback-demo` webhook.site demo, `@secauditb20y/sec-test-r3b` self-labeled sec-test POC, `webautomation_js` + `@ferudionz/*` obfuscator.io RC4 runtime exfil trio, `@guangnao/agent-proxy` Claude/Codex credential monetizer to `hub.client-llm.com`, `@lodash-js/lodash-js` Xelis miner, `@divineubg/divine` ntfy.sh EventSource C2, `@demopack/www` iOS iframe exploit injector, `@ghost_debugger/nanocache` hidden Windows binary launcher, `datefmt-simple-utils` reverse shell to `8.135.48.40:4444`, `registrynpmjs.to` typosquat cluster (`@polymarkets/clob-client-v2`, `@devmikets/hyperliquid-sdk`), Brazilian `alelo-*` dep-confusion cluster to `209.99.185.109`, plus `@peptideventure/*`, `@mexc/shared-utils`, `sui-gql-lite`, `bcs-mini`)

> ~27 npm CWE-506 advisories published 2026-08-14 (initial 4 clusters backfilled 08-15 with 8 more). Headliners: `@guangnao/agent-proxy` Claude/Codex credential monetiser to `hub.client-llm.com`, `@lodash-js/lodash-js` Xelis miner, `@divineubg/divine` ntfy.sh EventSource C2, `registrynpmjs.to` typosquat pair (`@polymarkets/clob-client-v2`, `@devmikets/hyperliquid-sdk`), Brazilian `alelo-*` dep-confusion cluster to `209.99.185.109`, `datefmt-simple-utils` reverse shell to `8.135.48.40:4444`, `@ghost_debugger/nanocache` Windows binary launcher.

- Published: 2026-08-14
- Last updated: 2026-08-15
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 26 packages, 42 compromised versions
- Tags: typosquat, credential-theft, obfuscation, dependency-confusion, infostealer, crypto-wallet-drain
- Also known as: 2026-08-14 GHSA npm batch, jchunt.top telemetry-canary series day-2, webhook.site preinstall register day-3, registrynpmjs.to typosquat wave, alelo-* Brazilian Alelo dep-confusion cluster, obfuscator.io RC4 runtime-exfil trio
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector
- Incident ID: npm-2026-08-14-ghsa-malware-sweep

## Affected packages (26)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@demopack/www](https://dependencywatch.io/package/npm/@demopack/www) | npm | 0.0.12 |
| [@devmikets/hyperliquid-sdk](https://dependencywatch.io/package/npm/@devmikets/hyperliquid-sdk) | npm | 1.9.6 |
| [@divineubg/divine](https://dependencywatch.io/package/npm/@divineubg/divine) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
| [@ferudionz/web_logger_js](https://dependencywatch.io/package/npm/@ferudionz/web_logger_js) | npm | 1.0.0 |
| [@ferudionz/webautomation](https://dependencywatch.io/package/npm/@ferudionz/webautomation) | npm | 1.0.0 |
| [@ghost_debugger/nanocache](https://dependencywatch.io/package/npm/@ghost_debugger/nanocache) | npm | 0.1.1 |
| [@guangnao/agent-proxy](https://dependencywatch.io/package/npm/@guangnao/agent-proxy) | npm | 1.2.1, 1.4.0, 1.4.2 |
| [@lodash-js/lodash-js](https://dependencywatch.io/package/npm/@lodash-js/lodash-js) | npm | 0.1.0, 0.2.0, 0.3.0 |
| [@mexc/shared-utils](https://dependencywatch.io/package/npm/@mexc/shared-utils) | npm | 1.0.0 |
| [@peptideventure/peptide-score-modifier](https://dependencywatch.io/package/npm/@peptideventure/peptide-score-modifier) | npm | 1.0.0 |
| [@peptideventure/peptide-unit](https://dependencywatch.io/package/npm/@peptideventure/peptide-unit) | npm | 1.0.0 |
| [@polymarkets/clob-client-v2](https://dependencywatch.io/package/npm/@polymarkets/clob-client-v2) | npm | 1.0.6 |
| [@secauditb20y/sec-test-r3b](https://dependencywatch.io/package/npm/@secauditb20y/sec-test-r3b) | npm | 1.0.0 |
| [alelo-client](https://dependencywatch.io/package/npm/alelo-client) | npm | 99.0.0, 99.0.2 |
| [alelo-common](https://dependencywatch.io/package/npm/alelo-common) | npm | 99.0.0 |
| [alelo-core](https://dependencywatch.io/package/npm/alelo-core) | npm | 99.0.0, 99.0.1, 99.0.2 |
| [alelo-payment](https://dependencywatch.io/package/npm/alelo-payment) | npm | 99.0.0, 99.0.2 |
| [alelo-services](https://dependencywatch.io/package/npm/alelo-services) | npm | 99.0.0, 99.0.2 |
| [alelo-utils](https://dependencywatch.io/package/npm/alelo-utils) | npm | 99.0.0 |
| [bcs-mini](https://dependencywatch.io/package/npm/bcs-mini) | npm | 1.0.0 |
| [datefmt-simple-utils](https://dependencywatch.io/package/npm/datefmt-simple-utils) | npm | 1.0.0 |
| [meualelo](https://dependencywatch.io/package/npm/meualelo) | npm | 99.0.0 |
| [preinstall-hook-webhook-callback-demo](https://dependencywatch.io/package/npm/preinstall-hook-webhook-callback-demo) | npm | 1.0.0, 1.0.1 |
| [sui-gql-lite](https://dependencywatch.io/package/npm/sui-gql-lite) | npm | 1.0.0 |
| [webautomation_js](https://dependencywatch.io/package/npm/webautomation_js) | npm | 1.0.0, 1.0.1 |
| [xrblocks-mcp](https://dependencywatch.io/package/npm/xrblocks-mcp) | npm | 6.3.1 |

## What happened

On 2026-08-14, the GitHub Advisory Database published **at least 27 new npm CWE-506 (Embedded Malicious Code) advisories** (this record initially covered only the first 4 named clusters and was backfilled 2026-08-15 with the remaining ~22 packages once GHSA re-indexed the full day). The most notable single item is a continuation of the `jchunt.top` telemetry-canary operator series established the day before; the day also brings a Claude/Codex credential monetizer, an active Xelis cryptominer, an EventSource-C2 backdoor, a reverse-shell dropper, a `registrynpmjs.to` typosquat mini-wave, and a Brazilian Alelo-scope dependency-confusion cluster.

## Cluster A - `jchunt.top` telemetry-canary series day-2

| Package | Versions | GHSA | Endpoint |
|---|---|---|---|
| `xrblocks-mcp` | `6.3.1` | GHSA-pwwg-f86j-hmv7 | `6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp` |

Same per-package-subdomain `*.instances.poc.jchunt.top` operator pattern as [08-13 `wct-st` and `tizen-webdriver-cli`](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep). Postinstall collects hostname/platform/arch/Node-version/package-name/ISO-timestamp, HTTPS-POSTs to package-specific subdomain, silent error suppression. Naming targets `xrblocks` (WebXR block libraries) and the MCP (Model Context Protocol) tooling ecosystem.

## Cluster B - `preinstall-hook-webhook-callback-demo` webhook.site preinstall demo

| Package | Versions | GHSA |
|---|---|---|
| `preinstall-hook-webhook-callback-demo` | `1.0.0`, `1.0.1` | GHSA-9j5p-xwfm-m987 |

Preinstall HTTPS-callback to `webhook.site`. Self-labeled demo but executes unconditionally. Same webhook.site preinstall exfil register as [08-13 Cluster D `@khaznatech/*`](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep) and [08-12 Cluster G `mcp-util-helpers`](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) - the webhook.site register is now a daily-recurring operator class.

## Cluster C - `@secauditb20y/sec-test-r3b` self-labeled sec-test proof-of-execution POC

| Package | Versions | GHSA |
|---|---|---|
| `@secauditb20y/sec-test-r3b` | `1.0.0` | GHSA-whmg-4w65-37cm |

Postinstall `node -e` invoking `fs.writeFileSync` to `/tmp/PWN_R3REAL/FIRED`. Package `main` exports only the literal `42`. Self-identifies as authorized security test - advisory judges the labeling non-mitigating and treats it as malware.

## Cluster D - `webautomation_js` obfuscator.io RC4 runtime exfil

| Package | Versions | GHSA |
|---|---|---|
| `webautomation_js` | `1.0.0`, `1.0.1` | GHSA-v4hj-5v4c-hpx9 |

Obfuscator.io RC4 string-array + self-defending debugger-check wrapper. Exported function transmits caller-supplied arguments to a runtime-reconstructed URL - both the `axios` module reference and every URL fragment remain encrypted in the source. Advertised as "logger tool for validation entry"; actual behavior is unauthorized runtime data exfil. **This is the only 08-14 cluster whose exfil fires at runtime rather than install-time** - the exposure window is every call site, not just `npm install`, so `--ignore-scripts` does not mitigate.

## Cluster E - `@guangnao/agent-proxy` Claude/Codex credential monetizer

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `@guangnao/agent-proxy` | `1.2.1`, `1.4.0`, `1.4.2` | GHSA-p2xx-33v2-xwcj | `hub.client-llm.com` (WebSocket) |

On `agent-proxy start`, opens a WebSocket to a runtime-decoded endpoint (XOR+base64 with key `gnP2p!7xQ` from `dist/cli.js`), accepts remote `job` messages, and forwards them to `api.anthropic.com` (Claude) or ChatGPT/Codex upstreams using the installer's on-disk OAuth credentials. Streams responses back to the operator. Gated by `onlyIfCredentialed` so only hosts with active paid-tier Claude/Codex logins are monetised. Compromises the developer's account and violates vendor ToS.

## Cluster F - `@lodash-js/lodash-js` Xelis cryptominer

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `@lodash-js/lodash-js` | `0.1.0`, `0.2.0`, `0.3.0` | GHSA-6gwm-c74j-jfv9 | `analytics.baskirill-an.workers.dev/configs/boostydownloader`, `api.ipify.org` |

Xelis Stratum miner auto-instantiates on import. Fetches mining config from a Cloudflare Workers subdomain, captures visitor IP via ipify. Typosquats the `lodash` namespace via the `@lodash-js` scope.

## Cluster G - `@divineubg/divine` ntfy.sh EventSource C2

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `@divineubg/divine` | `≤ 1.0.5` | GHSA-w83g-7xwj-mmqx | `ntfy.sh/dv-141u30-admin-cmd-/sse`, `ntfy.sh/dv-141u30-admin-status-` |

Exported `listen()` opens an EventSource to a public ntfy.sh channel, receives attacker JavaScript, evaluates it, and posts results back. Ntfy is a legitimate public pub/sub service - blocking `ntfy.sh` from application egress is a reasonable defense-in-depth.

## Cluster H - `registrynpmjs.to` typosquat wave

| Package | Versions | GHSA | Rogue registry |
|---|---|---|---|
| `@polymarkets/clob-client-v2` | `≤ 1.0.6` | GHSA-xq4g-rv84-pcvv | `registrynpmjs.to` |
| `@devmikets/hyperliquid-sdk` | `≤ 1.9.6` | GHSA-qw2c-ff44-52xq | `registrynpmjs.to` |

Both packages declare their `inquirer` dependency via a tarball URL pointing at the lookalike registry `registrynpmjs.to` (typosquats `registry.npmjs.org`). npm installs the tarball directly, so a compromised or attacker-controlled registry serves arbitrary lifecycle-script code as a transitive dependency. Block `registrynpmjs.to` at DNS. Same pattern as [08-12 `@polymarketstest/clob-client`](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep).

## Cluster I - `@demopack/www` iOS iframe exploit injection

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `@demopack/www` | `0.0.12` | GHSA-g447-2pwf-9jh2 | `cdn.jsdelivr.net/npm/@cdnshell/loader/a188ps10.js`, `unpkg.com/@themepack/dark/ah3zhsl.html` |

Disguised as static assets. iOS user-agent detection triggers a hidden iframe loading remote HTML via `unpkg.com/@themepack/dark`. Chinese comments describe a "primitive injection module" and sandbox testing. Non-iOS visitors unaffected; any site bundling this exposes its iOS users.

## Cluster J - `@ghost_debugger/nanocache` hidden Windows binary launcher

| Package | Versions | GHSA | Binary |
|---|---|---|---|
| `@ghost_debugger/nanocache` | `0.1.1` | GHSA-q5p2-m4qf-x2cr | `vendor/nanocache.exe` (1.1 MB, detached, `child.unref()`) |

On import, spawns a bundled `vendor/nanocache.exe` (not built from source in the tarball) with hidden-window flags and detaches it. Binary strings include `"/ws/agent"`, `"disconnect"`, `"update"`, `"exit_code"` - a WebSocket-based remote-control agent. Masquerades as an in-memory LRU/TTL cache.

## Cluster K - `datefmt-simple-utils` reverse shell

| Package | Versions | GHSA | C2 |
|---|---|---|---|
| `datefmt-simple-utils` | `1.0.0` | GHSA-8hx5-vj8g-mqv7 | `8.135.48.40:4444` (TCP, `/bin/bash`) |

`postinstall.js` opens a TCP socket to `8.135.48.40:4444` and attaches an interactive `/bin/bash` (with Python and Node fallbacks). Actual date-formatting functionality is non-functional.

## Cluster L - `alelo-*` Brazilian Alelo dep-confusion cluster

| Package | Versions | GHSA | Exfil |
|---|---|---|---|
| `alelo-common` | `99.0.0` | GHSA-4w9c-fcxm-hf28 | `209.99.185.109/preinstall`, `/postinstall` |
| `alelo-core` | `99.0.0`, `99.0.1`, `99.0.2` | GHSA-pwg9-w9cr-cg23 | same |
| `alelo-client` | `99.0.0`, `99.0.2` | GHSA-v865-m9wp-5xhc | same |
| `alelo-utils` | `99.0.0` | GHSA-chg6-4g6x-82gw | same |
| `alelo-services` | `99.0.0`, `99.0.2` | GHSA-f9gp-j44v-7447 | same |
| `alelo-payment` | `99.0.0`, `99.0.2` | GHSA-4whx-hjpv-g8xf | same |
| `meualelo` | `99.0.0` | GHSA-m6g5-fpx6-6x7v | same |

Alelo is a large Brazilian benefits/payments company. All seven packages published at version `99.x` (classic dependency-confusion high-version tactic), publisher `oxy12@proton.me`. Preinstall exfiltrates `hostname`, `username`, `platform`, `cwd`, and full `process.env` over HTTPS with `rejectUnauthorized:false`; postinstall additionally reads `.npmrc`, `.env`, and `package.json` and runs `whoami`/`id`. All traffic goes to bare-IP `209.99.185.109` - a straightforward network-block indicator. If you work at Alelo or a downstream vendor, treat internal npm publish tokens as burned.

## Cluster M - `@ferudionz/*` obfuscator.io RC4 runtime exfil pair (Cluster D siblings)

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `@ferudionz/webautomation` | `≤ 1.0.0` | GHSA-66vf-3wp7-7x3j | `connet(x)` POSTs caller arg to runtime-reconstructed URL |
| `@ferudionz/web_logger_js` | `1.0.0` | GHSA-wjf7-fv2q-889h | `connet(x)` GETs to runtime-reconstructed URL, `evm_account` install target |

Same exfil pattern as Cluster D `webautomation_js`: obfuscator.io RC4 string-array + self-defending debugger-check wrapper, destination URL and `axios` reference reconstructed at runtime from ~130 encoded literals across ~13 fragments. `web_logger_js` documentation says `npm install evm_account` - the name mismatch flags EVM/crypto address exfil targeting.

## Cluster N - miscellaneous single-package advisories

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `@mexc/shared-utils` | `1.0.0` | GHSA-r6r5-5xmc-9642 | Dep-confusion POC - postinstall writes marker `os.tmpdir()/mexc-poc-execution-proof.json`, no network |
| `@peptideventure/peptide-score-modifier` | `>= 0` | GHSA-jw4c-f75m-9wfj | Generic malware, no technical detail in advisory |
| `@peptideventure/peptide-unit` | `>= 0` | GHSA-73vr-mf4r-r3p5 | Generic malware, no technical detail in advisory |
| `sui-gql-lite` | `>= 0` | GHSA-r92j-xvgv-4q9c | Generic malware, Sui blockchain typosquat pattern |
| `bcs-mini` | `>= 0` | GHSA-9q3f-qc6p-62mm | Generic malware, Sui `bcs` (Binary Canonical Serialization) typosquat pattern |

## Registry state

All ~27 packages yanked or security-holding-replaced from npm during the 2026-08-14/15 takedown window. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

## Related tracked activity

- **`jchunt.top` telemetry-canary series** (Cluster A): day-2 continuation of [08-13 `wct-st`/`tizen-webdriver-cli`](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep) - same per-package-subdomain routing on `*.instances.poc.jchunt.top`.
- **webhook.site preinstall exfil register** (Cluster B): recurring class - [08-12 mcp-util-helpers](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep), [08-13 @khaznatech/*](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep), 08-14 preinstall-hook-webhook-callback-demo.
- **`registrynpmjs.to` typosquat wave** (Cluster H): builds on the [08-12 `@polymarketstest/clob-client`](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) sighting of the same rogue registry.
- **Obfuscator.io RC4 runtime-exfil operator** (Clusters D and M): three packages now share the `connet(x)` runtime-reconstructed-URL pattern.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `amazon-inspector`. No named threat actor.

## Impact

- **Cluster A - `jchunt.top` telemetry-canary series day-2 (1 new package `xrblocks-mcp`)**: `xrblocks-mcp@6.3.1` postinstall collects hostname/platform/arch/Node-version/package-name/ISO-timestamp and HTTPS-POSTs to a hardcoded package-specific endpoint `https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp`. Same per-package-subdomain `*.instances.poc.jchunt.top` operator pattern as [08-13 `wct-st` and `tizen-webdriver-cli`](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep). The README self-labels as a "security research canary" but transmits identifying host data unrelated to any stated `xrblocks-mcp` (WebXR MCP tooling) functionality and remains classified as malware by GHSA. Data exfiltrated is limited (hostname/platform/arch/Node version) but confirms the operator can enumerate hosts pulling the package - if you use `xrblocks` WebXR blocks or MCP tooling, uninstall and audit
- **Cluster B - `preinstall-hook-webhook-callback-demo` webhook.site preinstall demo (1 package, 2 versions)**: `preinstall-hook-webhook-callback-demo@1.0.0,1.0.1` runs a preinstall script that HTTPS-callbacks to `webhook.site` (an ephemeral request-capture service commonly used as an attacker-controlled exfil sink). Self-labeled demo but executes unconditionally on install - the "demo" label is not mitigating. Same webhook.site preinstall exfil register as [08-13 Cluster D `@khaznatech/*`](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep)
- **Cluster C - `@secauditb20y/sec-test-r3b` self-labeled sec-test proof-of-execution POC (1 package)**: `@secauditb20y/sec-test-r3b@1.0.0` postinstall runs `node -e` invoking `fs.writeFileSync` to create `/tmp/PWN_R3REAL/FIRED` on the installer's machine. Package `main` module exports only the literal value `42` - no legitimate reason for install-time filesystem writes. Self-identifies as an authorized security test in metadata but the advisory notes this labeling is **non-mitigating and functionally equivalent to malware dropper behavior**. Writing outside the package directory demonstrates arbitrary-write RCE primitive
- **Cluster D - `webautomation_js` obfuscator.io RC4 runtime exfil with hidden URL (1 package, 2 versions)**: `webautomation_js@1.0.0,1.0.1` `index.js` uses obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The exported function accepts caller-supplied arguments and sends them to a hidden, attacker-controlled endpoint whose destination URL is **reconstructed at runtime from the RC4-encoded string array** - the destination is not visible in normal source code. Both the `axios` module name and every fragment of the destination URL remain encrypted until execution. Advertised as "logger tool for validation entry"; actual behavior is unauthorized runtime exfil of any data passed to the function. Any code path invoking the exported function unknowingly transmits data to the operator - broader than an install-time exfil because the data being exfiltrated is caller-supplied (potentially payloads, credentials, form data) at runtime

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the full 2026-08-14 package list below
2. **For `xrblocks-mcp` matches (Cluster A - jchunt.top telemetry day-2)**: uninstall, correct to the real `xrblocks` WebXR library or your intended MCP tooling package, block outbound to `*.instances.poc.jchunt.top` at the network edge (same operator pattern as [08-13 wct-st/tizen-webdriver-cli](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep) - block covers both days)
3. **For `preinstall-hook-webhook-callback-demo` matches (Cluster B)**: uninstall - block outbound to `webhook.site` from build hosts as defense-in-depth against the broader webhook.site preinstall exfil register (same class as [08-13 @khaznatech/*](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep) and [08-12 mcp-util-helpers](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep))
4. **For `@secauditb20y/sec-test-r3b` matches (Cluster C)**: uninstall and delete `/tmp/PWN_R3REAL/FIRED` on any affected host - the write is a marker, but the RCE primitive it demonstrates means the operator could have written arbitrary content at that path. If you operate `secauditb20y` as an npm publisher or scope owner, escalate - the "sec test" label is used unauthorised in the advisory's judgement
5. **For `webautomation_js` matches (Cluster D - obfuscator.io RC4 runtime exfil)**: uninstall immediately. **Do not assume this is install-time-only** - the exfil fires every time the exported function is called at runtime, so any data passed to the function during the exposure window has been transmitted to the operator. Audit call sites for what data was passed, rotate any credentials/tokens/form data / user input that may have flowed through the function, and block outbound to `axios` runtime destinations you cannot account for
6. For all npm installs in CI, run with `--ignore-scripts` as defense-in-depth (mitigates Clusters A/B/C - does NOT mitigate D which fires at runtime on caller invocation)
7. Verify none of the 2026-08-14 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-pwwg-f86j-hmv7 - xrblocks-mcp (jchunt.top telemetry day-2)](https://github.com/advisories/GHSA-pwwg-f86j-hmv7) - GitHub
- [GHSA-9j5p-xwfm-m987 - preinstall-hook-webhook-callback-demo (webhook.site preinstall exfil)](https://github.com/advisories/GHSA-9j5p-xwfm-m987) - GitHub
- [GHSA-whmg-4w65-37cm - @secauditb20y/sec-test-r3b (/tmp/PWN_R3REAL/FIRED proof-of-execution)](https://github.com/advisories/GHSA-whmg-4w65-37cm) - GitHub
- [GHSA-v4hj-5v4c-hpx9 - webautomation_js (obfuscator.io RC4 runtime exfil)](https://github.com/advisories/GHSA-v4hj-5v4c-hpx9) - GitHub
- [GHSA-6r3v-5c9p-jv7v - wct-st (08-13 jchunt.top telemetry sibling)](https://github.com/advisories/GHSA-6r3v-5c9p-jv7v) - GitHub
- [GHSA-p2xx-33v2-xwcj - @guangnao/agent-proxy (Claude/Codex credential monetiser)](https://github.com/advisories/GHSA-p2xx-33v2-xwcj) - GitHub
- [GHSA-6gwm-c74j-jfv9 - @lodash-js/lodash-js (Xelis miner)](https://github.com/advisories/GHSA-6gwm-c74j-jfv9) - GitHub
- [GHSA-w83g-7xwj-mmqx - @divineubg/divine (ntfy.sh EventSource C2)](https://github.com/advisories/GHSA-w83g-7xwj-mmqx) - GitHub
- [GHSA-xq4g-rv84-pcvv - @polymarkets/clob-client-v2 (registrynpmjs.to typosquat)](https://github.com/advisories/GHSA-xq4g-rv84-pcvv) - GitHub
- [GHSA-qw2c-ff44-52xq - @devmikets/hyperliquid-sdk (registrynpmjs.to typosquat)](https://github.com/advisories/GHSA-qw2c-ff44-52xq) - GitHub
- [GHSA-g447-2pwf-9jh2 - @demopack/www (iOS iframe exploit injection)](https://github.com/advisories/GHSA-g447-2pwf-9jh2) - GitHub
- [GHSA-q5p2-m4qf-x2cr - @ghost_debugger/nanocache (hidden Windows binary launcher)](https://github.com/advisories/GHSA-q5p2-m4qf-x2cr) - GitHub
- [GHSA-8hx5-vj8g-mqv7 - datefmt-simple-utils (reverse shell 8.135.48.40:4444)](https://github.com/advisories/GHSA-8hx5-vj8g-mqv7) - GitHub
- [GHSA-pwg9-w9cr-cg23 - alelo-core (Brazilian Alelo dep-confusion cluster)](https://github.com/advisories/GHSA-pwg9-w9cr-cg23) - GitHub
- [GHSA-66vf-3wp7-7x3j - @ferudionz/webautomation (obfuscator.io RC4 sibling)](https://github.com/advisories/GHSA-66vf-3wp7-7x3j) - GitHub
- [GHSA-wjf7-fv2q-889h - @ferudionz/web_logger_js (obfuscator.io RC4 sibling, evm_account target)](https://github.com/advisories/GHSA-wjf7-fv2q-889h) - GitHub
- [GHSA-r6r5-5xmc-9642 - @mexc/shared-utils (dep-confusion POC)](https://github.com/advisories/GHSA-r6r5-5xmc-9642) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-14-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-14-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).