# GitHub Advisory npm CWE-506 sweep - 2026-08-15 batch (`@velliajs/discord` `discord.js` impersonator with hardcoded GitHub PAT + hidden `_verifyAuthorization` kill-switch, `akamai(js)-sensor` Google-Calendar invisible-Unicode C2 trio, HackerOne/Twilio `*-probe`/`*-poc` bug-bounty-canary droppers with live payloads, `depcruise-*` + `gunzip-js` `99.9.1` dependency-confusion canary, `@wololasod/tiny-id` RC4 Windows/Linux dropper, `@finaxis/common-js` Xelis miner, `*-vim` naming-canary pair, plus IP/webhook exfiltrators)

> 22 npm CWE-506 advisories published 2026-08-15 - the day's headline is **`@velliajs/discord@1.0.3..1.0.7`**, a `discord.js` impersonator with two live hardcoded GitHub PATs, an unpinned private-repo `sysframe` dependency the operator can hot-swap, and a hidden `Client.login()` `_verifyAuthorization` allowlist kill-switch. Same-day clusters include a 3-package `akamai(js)-sensor` Google-Calendar-dead-drop trio using invisible-Unicode payloads, HackerOne/Twilio `*-probe`/`*-poc` bug-bounty-canary droppers with real credential exfil, a `depcruise-*` + `gunzip-js` `99.9.1` OpenSSF-domain-flagged canary group, `@wololasod/tiny-id` RC4 dropper, `@finaxis/common-js` Xelis miner, `adxaa` WordPress account-takeover, and a matching `*-vim` naming-canary pair.

- Published: 2026-08-15
- Last updated: 2026-08-16
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 22 packages, 57 compromised versions
- Tags: typosquat, credential-theft, account-takeover, obfuscation, dependency-confusion, cdn-supply-chain
- Also known as: 2026-08-15 GHSA npm batch, *-vim naming-canary pair, akamai(js) Google-Calendar C2 trio, HackerOne/Twilio bug-bounty-canary droppers, depcruise 99.9.1 dep-confusion canary
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis
- Incident ID: npm-2026-08-15-ghsa-malware-sweep

## Affected packages (22)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@finaxis/common-js](https://dependencywatch.io/package/npm/@finaxis/common-js) | npm | 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4 |
| [@openrepl/shared](https://dependencywatch.io/package/npm/@openrepl/shared) | npm | 0.0.4, 0.0.5 |
| [@velliajs/discord](https://dependencywatch.io/package/npm/@velliajs/discord) | npm | 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 |
| [@wololasod/tiny-id](https://dependencywatch.io/package/npm/@wololasod/tiny-id) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3 |
| [adxaa](https://dependencywatch.io/package/npm/adxaa) | npm | 1.0.0 |
| [akamai-sensor](https://dependencywatch.io/package/npm/akamai-sensor) | npm | 1.0.0 |
| [akamaijs-sensor](https://dependencywatch.io/package/npm/akamaijs-sensor) | npm | 2.0.0, 3.0.0 |
| [akamaijs-sensorv1](https://dependencywatch.io/package/npm/akamaijs-sensorv1) | npm | 3.0.0 |
| [autbank-core](https://dependencywatch.io/package/npm/autbank-core) | npm | 99.0.0, 99.0.2 |
| [depcruise-baseline](https://dependencywatch.io/package/npm/depcruise-baseline) | npm | 99.9.1 |
| [depcruise-fmt](https://dependencywatch.io/package/npm/depcruise-fmt) | npm | 99.9.1 |
| [depcruise-wrap-stream-in-html](https://dependencywatch.io/package/npm/depcruise-wrap-stream-in-html) | npm | 99.9.1 |
| [fastly-vcl-language-client](https://dependencywatch.io/package/npm/fastly-vcl-language-client) | npm | 1.0.0 |
| [gunzip-js](https://dependencywatch.io/package/npm/gunzip-js) | npm | 99.9.1 |
| [harmony-app-toolkit](https://dependencywatch.io/package/npm/harmony-app-toolkit) | npm | 21.0.0, 22.0.0 |
| [hunterone-build-probe-9210](https://dependencywatch.io/package/npm/hunterone-build-probe-9210) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 |
| [kit-hydration-vim](https://dependencywatch.io/package/npm/kit-hydration-vim) | npm | 1.0.0 |
| [require-i18next](https://dependencywatch.io/package/npm/require-i18next) | npm | 20.0.0, 21.0.0 |
| [svelte-goal-vim](https://dependencywatch.io/package/npm/svelte-goal-vim) | npm | 1.0.0 |
| [tw-pkgprobe-7731](https://dependencywatch.io/package/npm/tw-pkgprobe-7731) | npm | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1 |
| [twilio-hackerone-poc-afe6937c](https://dependencywatch.io/package/npm/twilio-hackerone-poc-afe6937c) | npm | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
| [upload-to-gcp](https://dependencywatch.io/package/npm/upload-to-gcp) | npm | 3.2.1 |

## What happened

On 2026-08-15, the GitHub Advisory Database published **22 new npm CWE-506 (Embedded Malicious Code) advisories** - initially indexed as a quiet 3-package day, backfilled 2026-08-16 to the full 22-package count as OpenSSF Package Analysis and the GHSA reviewer queue caught up.

## Cluster A - `@velliajs/discord` `discord.js` impersonator with hardcoded GitHub PAT + hidden `_verifyAuthorization` kill-switch

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `@velliajs/discord` | `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6`, `1.0.7` | GHSA-5546-mfxg-3v4r | Two live hardcoded GitHub PATs; unpinned `sysframe` private-repo dep fetched via PAT; hidden `Client.login()` `_verifyAuthorization` allowlist fetched via second PAT |

The hardcoded PATs are the operator's primary lever - they give a single account write access to the `sysframe` private repository, so the operator can hot-swap the runtime dependency at any time and deliver arbitrary code (including lifecycle scripts) at every subsequent install. The `_verifyAuthorization` allowlist doubles as a hidden kill-switch (the bot silently refuses to run unless the caller is whitelisted) and as a beacon that fires on every `Client.login()` call to enumerate live installations. This is a more targeted design than a generic dropper: the operator can quietly gate execution against specific victims while the majority of accidental installers see nothing happen.

The impersonation target is `discord.js`, the ubiquitous Discord bot library - a classic install-time confusion vector for anyone typo-installing a scoped variant.

## Cluster B - `akamai(js)-sensor` Google-Calendar-dead-drop invisible-Unicode C2 trio

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `akamai-sensor` | `1.0.0` | GHSA-5rgj-m8xx-vvvj | Invisible-Unicode payload in `index.js` decoded and executed via `new Function()` on `sensor()` call; Google Calendar ICS feed dead-drop |
| `akamaijs-sensor` | `2.0.0`, `3.0.0` | GHSA-86x5-fp9h-hxg3 | Same invisible-Unicode + `new Function()` + Google Calendar C2 pattern; `sync-metrics.js` decoder |
| `akamaijs-sensorv1` | `>= 3.0.0` | GHSA-vf6f-mfc3-9548 | Same pattern; parses ICS event descriptions for base64 URLs rewritten to `/generate` |

All three impersonate Akamai's Bot Manager `sensor_data` SDK. The invisible-Unicode payload is steganographic - the file looks like ordinary JavaScript in any editor that doesn't highlight variation-selector characters, and the payload only materialises when the decoder runs at call time (not at import time), which evades scanners that only inspect top-level module code. The Google Calendar ICS feed as C2 is a nasty choice: `calendar.google.com` is allow-listed on virtually every corporate egress firewall, and the attacker can rotate the actual malicious endpoint by editing the calendar event without ever touching the package again.

## Cluster C - HackerOne / Twilio `*-probe` / `*-poc` bug-bounty-canary droppers with LIVE payloads

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `hunterone-build-probe-9210` | `1.0.0`, `1.0.1`, `1.0.2`, `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6`, `1.0.7` | GHSA-7vcv-c883-w3f6 | Install-hook `probe.js` collects hostname/platform/net-ifaces/env vars/AWS creds (`~/.npmrc`, `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`); POSTs to webhook |
| `twilio-hackerone-poc-afe6937c` | `1.0.0`, `1.0.1`, `1.0.2`, `1.0.3`, `1.0.4` | GHSA-967c-3f68-4gxj | Preinstall/postinstall reconnaissance + AWS Lambda env vars + persistent temp-dir-watching daemon + cross-tenant `node_modules` injection |
| `tw-pkgprobe-7731` | `1.0.0`, `1.0.1`, `1.0.3`, `1.0.4`, `1.0.5`, `1.0.6`, `1.0.7`, `1.1.0`, `1.1.1` | GHSA-449r-r4hm-3v9g | Twilio Serverless-targeted background daemon + account-ID scan + cross-tenant token capture; falsely brands as authorised security research tool |

All three abuse the ambient trust that comes with bug-bounty-flavoured naming (`hackerone`, `hunterone`, HackerOne-style `-poc-<hex>` suffix). Defenders who spot the install may hesitate to remove it, assuming it belongs to an authorised researcher. The payload is a real dropper: AWS ECS + Lambda credential paths + `~/.npmrc` tokens shipped to an anonymous webhook.

## Cluster D - `depcruise-*` + `gunzip-js` `99.9.1` dependency-confusion canary group

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `depcruise-wrap-stream-in-html` | `99.9.1` | GHSA-8r7w-6hqf-4x5p | Runtime dependency `ltidisafe` fetched from arbitrary Google Cloud Storage tarball URL; bucket owner can swap contents at any time without republishing |
| `depcruise-fmt` | `99.9.1` | GHSA-29c8-59h2-f6pq | OpenSSF Package Analysis: contacts domain associated with malicious activity |
| `depcruise-baseline` | `99.9.1` | GHSA-944r-8f8q-66p7 | OpenSSF Package Analysis: contacts domain associated with malicious activity |
| `gunzip-js` | `99.9.1` | GHSA-ff3p-88cr-hc25 | OpenSSF Package Analysis: contacts domain associated with malicious activity |

All four share the tell-tale `99.9.1` version - the "outrun-the-real-version" tactic for dependency-confusion attacks against internal registries that resolve to the highest available version. Three names shadow `dependency-cruiser` helper conventions; the fourth shadows a legitimate `gunzip-js` primitive.

## Cluster E - `kit-hydration-vim` + `svelte-goal-vim` `*-vim` naming-canary uncharacterised pair

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `kit-hydration-vim` | `>= 0` (all versions) | GHSA-g9cm-v642-m5rj | Generic GHSA malware boilerplate, no per-package detail |
| `svelte-goal-vim` | `>= 0` (all versions) | GHSA-qx34-66jv-3pg5 | Generic GHSA malware boilerplate, no per-package detail |

The shared `*-vim` naming across two same-day publications strongly suggests one operator running a naming-canary sweep against Svelte / SvelteKit / Vim adjacent namespaces. No IOCs published; treat as arbitrary malware.

## Cluster F - Cross-target singletons

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `@wololasod/tiny-id` | `0.1.0`, `0.1.1`, `0.1.2`, `0.1.3` | GHSA-5mh7-hwqc-6rxw | obfuscator.io + RC4 VM; downloads Windows/Linux binary to `%APPDATA%` / temp; VBS launcher on Windows, detached spawn on Linux; payload hidden in `.d.ts` |
| `@openrepl/shared` | `0.0.4`, `0.0.5` | GHSA-2253-v578-ppx8 | `preinstall` shells out to public request-inspection service with username + hostname |
| `autbank-core` | `99.0.0`, `99.0.2` | GHSA-96pg-c3cg-m9h7 | Preinstall env-var scan for API-key/secret/token substrings + `.env` + `package.json`, POST to webhook; postinstall backup exfil |
| `adxaa` | `1.0.0` | GHSA-3394-pf38-xc3x | WordPress domain-gated payload for `noviembrenacional.com`; exfiltrates HTML + username, deletes account, hijacks via ProtonMail email swap + password reset |
| `@finaxis/common-js` | `<= 0.3.4` (`0.3.0`, `0.3.1`, `0.3.2`, `0.3.3`, `0.3.4`) | GHSA-cxv6-5ffv-7w2g | Obfuscated lodash-lookalike shipping a Xelis (XEL) proof-of-work miner; stratum client + Web Worker + embedded WASM |
| `fastly-vcl-language-client` | `1.0.0` | GHSA-c94r-gh3m-qm4g | Preinstall exfil of public IP + hostname + CI env vars (GitHub Actions) via webhook + DNS |
| `upload-to-gcp` | `3.2.1` | GHSA-jx3f-5x53-4484 | Postinstall exfil of host + platform + arch + Node + pkg metadata to `z5owtt3g.instances.poc.jchunt.top/upload-to-gcp` |
| `require-i18next` | `20.0.0`, `21.0.0` | GHSA-4m9p-v3v7-c5xh | OpenSSF: contacts malicious domain and executes command |
| `harmony-app-toolkit` | `21.0.0`, `22.0.0` | GHSA-qp2p-qrmg-36rq | OpenSSF: contacts malicious domain and executes command |

## Registry state

All 22 packages yanked or security-holding-replaced from npm during the 2026-08-15 through 2026-08-16 takedown window. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

## Related tracked activity

- **08-14 backfill context**: the [08-14 sweep](https://dependencywatch.io/incident/npm-2026-08-14-ghsa-malware-sweep) covered ~27 packages including the Claude/Codex credential monetiser `@guangnao/agent-proxy`, the `registrynpmjs.to` typosquat wave, and the Brazilian `alelo-*` dep-confusion cluster.
- **Hardcoded-GitHub-PAT impersonators** (Cluster A): a variant of the credential-embedded delivery pattern - the `sysframe` private-repo trick makes this a live-update malware channel rather than a one-shot dropper.
- **Google-Calendar dead-drop C2** (Cluster B): joins the small-but-growing family of allow-listed-SaaS-as-C2 supply-chain attacks; similar to Zulip, Slack webhooks, and Notion abuse seen in earlier 2026 waves.
- **HackerOne/Twilio-brand canaries** (Cluster C): differ from the pure OSSF `research-canary` group in that they ship real functional droppers, not passive beacons.
- **`99.9.1` dependency-confusion canary** (Cluster D): recurring signature we've seen in previous internal-namespace sweeps.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`. No named threat actor.

## Impact

- **Cluster A - `@velliajs/discord` `discord.js` impersonator with hardcoded GitHub PAT + hidden kill-switch (1 package, 5 versions)**: `@velliajs/discord@1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7` impersonates the popular `discord.js` library. Two live hardcoded **GitHub Personal Access Tokens** are embedded in the package source. `package.json` declares a runtime dependency on `sysframe` fetched from a private GitHub repository via one of the embedded PATs - the repository is unpinned, so its author can rewrite it at any time and deliver arbitrary code (including lifecycle scripts) at every install. `Client.login()` runs an undocumented `_verifyAuthorization` routine that fetches an allowlist from a hardcoded GitHub URL using the second PAT, and the bot refuses to operate unless the caller is whitelisted - this is a hidden runtime kill-switch that both gives the operator remote enable/disable control and forces every running installation to beacon out on startup. Impact if consumed: `sysframe` code executes with the calling app's privileges; the beacon leaks the fact that the caller is running the package plus any environment data attached to the allowlist check; the operator can gate execution to specific targets
- **Cluster B - `akamai(js)-sensor` Google-Calendar-dead-drop invisible-Unicode C2 trio (3 packages, 4 versions)**: `akamai-sensor@1.0.0`, `akamaijs-sensor@2.0.0, 3.0.0`, `akamaijs-sensorv1@>=3.0.0` all impersonate the legitimate Akamai Bot Manager `sensor_data` anti-bot SDK. All three conceal executable JavaScript inside `index.js` using invisible **Unicode variation-selector and tag characters**, then decode them at runtime and execute via `new Function()` when the `sensor()` API is called. The dead-drop channel is a hardcoded public **Google Calendar ICS feed**: the packages parse event descriptions, extract base64-encoded URLs, rewrite them to `/generate` endpoints, and fetch commands - the operator changes the target endpoint by editing calendar events, no republish needed. This is a mutable, hard-to-block C2 channel (calendar.google.com is allowlisted almost everywhere). Impact: full RCE within the calling Node process on any host that instantiates the fake sensor
- **Cluster C - HackerOne / Twilio `*-probe` / `*-poc` bug-bounty-canary droppers with LIVE payloads (3 packages, 21 versions)**: `hunterone-build-probe-9210@1.0.0..1.0.7`, `twilio-hackerone-poc-afe6937c@1.0.0..1.0.4`, `tw-pkgprobe-7731@1.0.0..1.1.1` masquerade as authorised bug-bounty research probes but ship real install-time droppers. All three chain `preinstall`/`postinstall` hooks to collect hostname, platform, network interfaces, environment variables, **AWS credentials** (`~/.npmrc` auth tokens, `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`, **AWS Lambda environment variables**), and Twilio account identifiers, then POST them to an external webhook collector. `tw-pkgprobe-7731` and `twilio-hackerone-poc-afe6937c` additionally deploy a persistent background daemon that watches temp dirs and performs **cross-tenant injection** by writing malicious modules into other accounts' `node_modules` directories. Impact: installer-owned secrets shipped to an anonymous third-party collector at install time, plus lateral movement in multi-tenant CI/serverless environments
- **Cluster D - `depcruise-*` + `gunzip-js` `99.9.1` dependency-confusion canary group (4 packages, 4 versions)**: `depcruise-wrap-stream-in-html@99.9.1`, `depcruise-fmt@99.9.1`, `depcruise-baseline@99.9.1`, `gunzip-js@99.9.1` all share the suspicious `99.9.1` marker version - the classic dep-confusion outrun-the-real-version signal. `depcruise-wrap-stream-in-html` explicitly declares a runtime dependency on `ltidisafe` fetched from an arbitrary Google Cloud Storage tarball URL, letting the bucket owner swap the payload contents without republishing to npm. The others (`depcruise-fmt`, `depcruise-baseline`, `gunzip-js`) were flagged by OpenSSF Package Analysis because they contact a domain associated with malicious activity. All three `depcruise-*` names shadow the popular `dependency-cruiser` toolkit's helper namespace; `gunzip-js` shadows a real gunzip helper. Impact: install-time RCE via the swappable GCS tarball on the `wrap-stream` variant; unknown-specific C2 on the OpenSSF-flagged siblings; treat all four as arbitrary malware
- **Cluster E - `*-vim` naming-canary uncharacterised pair (2 packages)**: `kit-hydration-vim` and `svelte-goal-vim` carry only the GHSA generic-malware boilerplate. The shared `*-vim` naming across two same-day publications strongly suggests one operator running a naming-canary sweep against Svelte / SvelteKit / Vim-adjacent namespaces
- **Cluster F - Cross-target singletons (9 packages, 15 versions)**: `@wololasod/tiny-id@0.1.0..0.1.3` (obfuscator.io + RC4 VM that downloads a Windows/Linux platform-specific executable to `%APPDATA%` / temp, launches via VBS on Windows and detached spawn on Linux, hides payload in `.d.ts`), `@openrepl/shared@0.0.4, 0.0.5` (`preinstall` shells out to public request-inspection service with username + hostname), `autbank-core@99.0.0, 99.0.2` (env-var scan for API-key/secret/token substrings + `.env` + `package.json`, POST to webhook), `adxaa@1.0.0` (domain-gated WordPress payload for `noviembrenacional.com` that exfiltrates HTML/username, deletes the account, hijacks credentials via ProtonMail email swap + password reset), `@finaxis/common-js@<=0.3.4` (Xelis proof-of-work miner posing as a lodash utility, stratum client + Web Worker mining loop + embedded WASM), `fastly-vcl-language-client@1.0.0` (`preinstall` collects public IP + hostname + GitHub Actions env vars, exfiltrates via webhook + DNS), `upload-to-gcp@3.2.1` (`postinstall` collects host/platform/Node/pkg metadata, POSTs to `z5owtt3g.instances.poc.jchunt.top/upload-to-gcp`), `require-i18next@20.0.0, 21.0.0` + `harmony-app-toolkit@21.0.0, 22.0.0` (OpenSSF: contacts malicious domain and executes command). Impact spans installer-secret theft, cryptomining, native-binary drop, and targeted account takeover

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for the 22 packages below
2. **For `@velliajs/discord` matches (Cluster A)**: uninstall immediately - the two hardcoded GitHub PATs mean the operator has already had time to hot-swap `sysframe` and to enumerate every caller. Rotate any Discord bot token that ever handled traffic through this package. Search history for the hardcoded PATs and report them to GitHub Secret Scanning if you can extract them. Correct to the real `discord.js` package. Block outbound to `github.com` API endpoints from bot hosts as defence-in-depth against the `_verifyAuthorization` allowlist beacon (or at minimum, log it)
3. **For `akamai(js)-sensor` matches (Cluster D)**: uninstall and treat any host that ever loaded the sensor as compromised. Block outbound to `calendar.google.com` (or at minimum ICS-feed URLs) from any host running Akamai integrations - the dead-drop is the entire C2 backbone. Consumers wanting the real Akamai sensor should switch to `akamai-bot-manager-nodejs-sdk` or Akamai's own documented package
4. **For `hunterone-build-probe-9210` / `twilio-hackerone-poc-*` / `tw-pkgprobe-*` matches (Cluster C)**: these are NOT authorised bug-bounty tooling - rotate ALL AWS credentials, npm registry tokens, Twilio account SIDs + auth tokens, and any secret exposed to the CI/serverless environment where the package installed. Audit sibling tenants' `node_modules` for injected modules if you run multi-tenant Lambda / serverless. Report the attacker webhook URLs upstream to HackerOne / Twilio triage
5. **For `depcruise-*` / `gunzip-js` `99.9.1` matches (Cluster D)**: uninstall and rotate every installer-side secret. If your CI ever installed `depcruise-wrap-stream-in-html`, treat the runner as compromised - the swappable GCS tarball means the payload seen at install time is not the payload that will ship tomorrow. Pin your `dependency-cruiser` install to the real scoped or unscoped upstream and configure your registry to reject unknown `depcruise-*` names
6. **For `@wololasod/tiny-id` matches (Cluster F)**: uninstall AND scan the host for a dropped executable in `%APPDATA%` (Windows) or `/tmp` (Linux) - the RC4 VM downloads a platform-specific binary that outlives the npm install. Kill any detached child process, check scheduled tasks / systemd user units for persistence, and reimage if the binary contents cannot be recovered for analysis
7. **For `@finaxis/common-js` matches**: uninstall and audit CPU/GPU + power-draw metrics on any host that ever imported it - the Xelis miner runs in a Web Worker as long as the process is alive. Rotate any pool address or mining-related config that shipped alongside the fake lodash utility
8. **For `adxaa` matches**: only exploitable if deployed on `noviembrenacional.com` - the payload is domain-gated. If that's you, invalidate all active sessions, reset every admin email, restore the deleted account from backup, and check for ProtonMail addresses in the WordPress user table
9. **For all Cluster F + Cluster E singletons + `kit-hydration-vim` / `svelte-goal-vim` matches**: uninstall, rotate any credentials accessible from the install host, and audit `.npmrc` and `.env` on the box. Several of these advisories carry no specific IOC - treat the host as if a full-control implant is running until reimaged
10. For all npm installs in CI, run with `--ignore-scripts` as defence-in-depth (mitigates the `preinstall`/`postinstall` droppers in Clusters C, D, and F, and the `sysframe`-style lifecycle-hook variants - does NOT mitigate Cluster A's runtime `_verifyAuthorization` beacon, `sysframe`'s code executing when imported, Cluster D's Google-Calendar C2 which fires when `sensor()` is called, or `@finaxis/common-js`'s miner which runs when the fake utility is required)
11. Verify none of the 22 2026-08-15 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-5546-mfxg-3v4r - @velliajs/discord (discord.js impersonator with hardcoded PAT + _verifyAuthorization kill-switch)](https://github.com/advisories/GHSA-5546-mfxg-3v4r) - GitHub
- [GHSA-5rgj-m8xx-vvvj - akamai-sensor (Google Calendar dead-drop + invisible-Unicode)](https://github.com/advisories/GHSA-5rgj-m8xx-vvvj) - GitHub
- [GHSA-86x5-fp9h-hxg3 - akamaijs-sensor (invisible-Unicode + Google Calendar C2)](https://github.com/advisories/GHSA-86x5-fp9h-hxg3) - GitHub
- [GHSA-vf6f-mfc3-9548 - akamaijs-sensorv1 (invisible-Unicode + Google Calendar C2)](https://github.com/advisories/GHSA-vf6f-mfc3-9548) - GitHub
- [GHSA-7vcv-c883-w3f6 - hunterone-build-probe-9210 (AWS credential exfiltration)](https://github.com/advisories/GHSA-7vcv-c883-w3f6) - GitHub
- [GHSA-967c-3f68-4gxj - twilio-hackerone-poc-afe6937c (Lambda env vars + cross-tenant node_modules injection)](https://github.com/advisories/GHSA-967c-3f68-4gxj) - GitHub
- [GHSA-449r-r4hm-3v9g - tw-pkgprobe-7731 (Twilio Serverless-targeted cross-tenant token capture)](https://github.com/advisories/GHSA-449r-r4hm-3v9g) - GitHub
- [GHSA-8r7w-6hqf-4x5p - depcruise-wrap-stream-in-html (swappable Google Cloud Storage tarball dropper)](https://github.com/advisories/GHSA-8r7w-6hqf-4x5p) - GitHub
- [GHSA-29c8-59h2-f6pq - depcruise-fmt (OpenSSF: malicious domain)](https://github.com/advisories/GHSA-29c8-59h2-f6pq) - GitHub
- [GHSA-944r-8f8q-66p7 - depcruise-baseline (OpenSSF: malicious domain)](https://github.com/advisories/GHSA-944r-8f8q-66p7) - GitHub
- [GHSA-ff3p-88cr-hc25 - gunzip-js (OpenSSF: malicious domain)](https://github.com/advisories/GHSA-ff3p-88cr-hc25) - GitHub
- [GHSA-5mh7-hwqc-6rxw - @wololasod/tiny-id (RC4 Windows/Linux dropper)](https://github.com/advisories/GHSA-5mh7-hwqc-6rxw) - GitHub
- [GHSA-2253-v578-ppx8 - @openrepl/shared (preinstall webhook exfiltration)](https://github.com/advisories/GHSA-2253-v578-ppx8) - GitHub
- [GHSA-96pg-c3cg-m9h7 - autbank-core (env-var credential harvest)](https://github.com/advisories/GHSA-96pg-c3cg-m9h7) - GitHub
- [GHSA-3394-pf38-xc3x - adxaa (WordPress noviembrenacional.com account takeover)](https://github.com/advisories/GHSA-3394-pf38-xc3x) - GitHub
- [GHSA-cxv6-5ffv-7w2g - @finaxis/common-js (Xelis miner disguised as lodash)](https://github.com/advisories/GHSA-cxv6-5ffv-7w2g) - GitHub
- [GHSA-c94r-gh3m-qm4g - fastly-vcl-language-client (public IP + CI env exfiltration)](https://github.com/advisories/GHSA-c94r-gh3m-qm4g) - GitHub
- [GHSA-jx3f-5x53-4484 - upload-to-gcp (jchunt.top postinstall exfil)](https://github.com/advisories/GHSA-jx3f-5x53-4484) - GitHub
- [GHSA-4m9p-v3v7-c5xh - require-i18next (OpenSSF: malicious domain + command execution)](https://github.com/advisories/GHSA-4m9p-v3v7-c5xh) - GitHub
- [GHSA-qp2p-qrmg-36rq - harmony-app-toolkit (OpenSSF: malicious domain + command execution)](https://github.com/advisories/GHSA-qp2p-qrmg-36rq) - GitHub
- [GHSA-g9cm-v642-m5rj - kit-hydration-vim (generic-malware boilerplate)](https://github.com/advisories/GHSA-g9cm-v642-m5rj) - GitHub
- [GHSA-qx34-66jv-3pg5 - svelte-goal-vim (generic-malware boilerplate)](https://github.com/advisories/GHSA-qx34-66jv-3pg5) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/npm-2026-08-15-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-08-15-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).