GitHub Advisory npm malware sweep, 11 November 2026
11 npm packages from GitHub malware advisories published 11 November 2026. Chalk/logging typosquats, @fadelsm Baileys/Signal forks, a Solana crypto lure, dependency-confusion probes, and misc CWE-506 boilerplate takedowns.
Published 11 Nov 2026
Every version named by the advisory is in the scanner, so a lockfile check finds it directly.
- Severity
- Medium
- Type
- Advisory sweep
- Published
- 11 Nov 2026
- Ecosystems
- npm
- Detected by
- OpenSSF
- Source
- github.com
Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
The full picture
GitHub published malware advisories for 11 npm packages on 11 November 2026. All received standard CWE-506 takedown notices with no published analysis of the payload. Severity is medium because no package has a confirmed payload beyond the boilerplate.
The chalk/logging typosquats (Cluster A) target developers searching for popular formatting utilities. The @fadelsm scoped packages (Cluster B) continue the Baileys WhatsApp library fork flood seen in the 10 November sweep. The Solana lure (Cluster C) and dep-confusion probes (Cluster D) follow familiar patterns from recent weeks.
11 packages 11 versions
- npm@fadelsm/baileys*→
- npm@fadelsm/libsignal-node*→
- npm@solana-trade/core*→
- npmchalks-log*→
- npmkbmathlessons*→
- npmnj-logger*→
- npmprettlog*→
- npmpt-logger-telemetry-eax0x1*→
- npmrex-react-diag-tools-v1*→
- npmtermchalk*→
- npmyummy-bolts*→
These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.
What it does if you installed it
- Cluster A: chalk/logging typosquats (typosquat; CWE-506 boilerplate, no published analysis) (3 packages):
chalks-log,prettlog,termchalk. Names mimic popular logging/formatting libraries (chalk, prettier). All versions flagged, no published payload analysis. - Cluster B: @fadelsm Baileys/Signal fork cluster (malicious-package; CWE-506 boilerplate, no published analysis) (2 packages):
@fadelsm/libsignal-node,@fadelsm/baileys. Scoped forks of the WhatsApp Baileys and Signal libraries under a fake publisher. Continuation of the Baileys fork flood seen on 10 November. - Cluster C: Solana crypto lure (malicious-package; CWE-506 boilerplate, no published analysis) (1 package):
@solana-trade/core. Crypto-themed fake SDK. - Cluster D: dependency-confusion probes (dependency-confusion; CWE-506 boilerplate, no published analysis) (2 packages):
pt-logger-telemetry-eax0x1,rex-react-diag-tools-v1. Internal-sounding names with version suffixes typical of dep-confusion probes. - Cluster E: misc CWE-506 takedowns (malicious-package; no published analysis) (3 packages):
kbmathlessons,yummy-bolts,nj-logger. Unrelated packages with no published analysis.
Clean-up steps
- Check your lockfiles for every package listed below, or upload them to the DependencyWatch scanner
- Typosquats (Cluster A): remove and verify you meant the legitimate package (chalk, prettier)
- @fadelsm forks (Cluster B): remove; rotate secrets if the host ran the package
- All others: remove and rebuild; rotate secrets if the host executed the package
Sources
- GitHub Advisory Database, npm malware advisories (11 Nov 2026)github.com
- GHSA-cm5x-2764-c8p9: chalks-loggithub.com
- GHSA-rq54-jmqc-j8qj: @solana-trade/coregithub.com
- GHSA-7gq6-hj7j-wgh8: @fadelsm/libsignal-nodegithub.com
- OpenSSF malicious-packages repositorygithub.com
Check your lockfile against this and every other incident.
Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.
