# GitHub Advisory npm malware sweep, 11 November 2026

> 11 npm packages from GitHub malware advisories published 11 November 2026. Chalk/logging typosquats, @fadelsm Baileys/Signal forks, a Solana crypto lure, dependency-confusion probes, and misc CWE-506 boilerplate takedowns.

- Published: 2026-11-11
- Severity: medium
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm
- Scope: 11 packages, 11 compromised versions
- Tags: typosquat, dependency-confusion
- Detected by: OpenSSF
- Incident ID: npm-2026-11-11-ghsa-malware-sweep

## Affected packages (11)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@fadelsm/baileys](https://dependencywatch.io/package/npm/@fadelsm/baileys) | npm | * |
| [@fadelsm/libsignal-node](https://dependencywatch.io/package/npm/@fadelsm/libsignal-node) | npm | * |
| [@solana-trade/core](https://dependencywatch.io/package/npm/@solana-trade/core) | npm | * |
| [chalks-log](https://dependencywatch.io/package/npm/chalks-log) | npm | * |
| [kbmathlessons](https://dependencywatch.io/package/npm/kbmathlessons) | npm | * |
| [nj-logger](https://dependencywatch.io/package/npm/nj-logger) | npm | * |
| [prettlog](https://dependencywatch.io/package/npm/prettlog) | npm | * |
| [pt-logger-telemetry-eax0x1](https://dependencywatch.io/package/npm/pt-logger-telemetry-eax0x1) | npm | * |
| [rex-react-diag-tools-v1](https://dependencywatch.io/package/npm/rex-react-diag-tools-v1) | npm | * |
| [termchalk](https://dependencywatch.io/package/npm/termchalk) | npm | * |
| [yummy-bolts](https://dependencywatch.io/package/npm/yummy-bolts) | npm | * |

## What happened

GitHub published malware advisories for 11 npm packages on 11 November 2026. All received standard CWE-506 takedown notices with no published analysis of the payload. Severity is `medium` because no package has a confirmed payload beyond the boilerplate.

The chalk/logging typosquats (Cluster A) target developers searching for popular formatting utilities. The @fadelsm scoped packages (Cluster B) continue the Baileys WhatsApp library fork flood seen in the 10 November sweep. The Solana lure (Cluster C) and dep-confusion probes (Cluster D) follow familiar patterns from recent weeks.

## Impact

- **Cluster A: chalk/logging typosquats (typosquat; CWE-506 boilerplate, no published analysis) (3 packages)**: `chalks-log`, `prettlog`, `termchalk`. Names mimic popular logging/formatting libraries (chalk, prettier). All versions flagged, no published payload analysis.
- **Cluster B: @fadelsm Baileys/Signal fork cluster (malicious-package; CWE-506 boilerplate, no published analysis) (2 packages)**: `@fadelsm/libsignal-node`, `@fadelsm/baileys`. Scoped forks of the WhatsApp Baileys and Signal libraries under a fake publisher. Continuation of the Baileys fork flood seen on 10 November.
- **Cluster C: Solana crypto lure (malicious-package; CWE-506 boilerplate, no published analysis) (1 package)**: `@solana-trade/core`. Crypto-themed fake SDK.
- **Cluster D: dependency-confusion probes (dependency-confusion; CWE-506 boilerplate, no published analysis) (2 packages)**: `pt-logger-telemetry-eax0x1`, `rex-react-diag-tools-v1`. Internal-sounding names with version suffixes typical of dep-confusion probes.
- **Cluster E: misc CWE-506 takedowns (malicious-package; no published analysis) (3 packages)**: `kbmathlessons`, `yummy-bolts`, `nj-logger`. Unrelated packages with no published analysis.

## What to do

1. **Check your lockfiles** for every package listed below, or upload them to the DependencyWatch scanner
2. **Typosquats** (Cluster A): remove and verify you meant the legitimate package (chalk, prettier)
3. **@fadelsm forks** (Cluster B): remove; rotate secrets if the host ran the package
4. **All others**: remove and rebuild; rotate secrets if the host executed the package

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database, npm malware advisories (11 Nov 2026)](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm+published%3A2026-11-11) - GitHub
- [GHSA-cm5x-2764-c8p9: chalks-log](https://github.com/advisories/GHSA-cm5x-2764-c8p9) - GitHub
- [GHSA-rq54-jmqc-j8qj: @solana-trade/core](https://github.com/advisories/GHSA-rq54-jmqc-j8qj) - GitHub
- [GHSA-7gq6-hj7j-wgh8: @fadelsm/libsignal-node](https://github.com/advisories/GHSA-7gq6-hj7j-wgh8) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/npm-2026-11-11-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/npm-2026-11-11-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).