GitHub Advisory quiet-tail sweep - 2026-08-16 / 2026-08-17 (`@ai-vertical/ai-agent` npm generic-malware + `kb-ai` PyPI OpenSSF `setup.py`-install pentest dep-confusion demo)

What happened

The 24-hour window ending 2026-08-17 06:00 UTC was a quiet-tail after the 08-15 22-package @velliajs/discord/akamai(js)-sensor/HackerOne-canary burst (see 2026-08-15 sweep). Only two GHSA CWE-506 advisories were published across npm + PyPI in that window, so both are collected here as a single multi-ecosystem entry rather than as two per-day sweep files.

@ai-vertical/ai-agent (npm)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | @ai-vertical/ai-agent | 1.0.0, 1.0.1 | GHSA-3248-8gvm-g9jv | 2026-08-17 | Generic malware boilerplate; no source or per-package IOC published |

The advisory body is the standard GHSA malware notice: "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer." No CVSS, no source repository, no observed C2, no payload description. The scope name suggests naming-canary targeting the AI-agent / LLM-tooling namespace (@ai-vertical) — a category we've seen repeatedly in earlier sweeps (@guangnao/agent-proxy on 08-14, the xrblocks-mcp MCP-scope canary on 08-14, @openrepl/shared on 08-15). Treat as full-control install-time execution until an IOC lands.

kb-ai (PyPI)

| Package | Versions | GHSA | Published | Behavior | |---|---|---|---|---| | kb-ai | 0.1.0, 0.1.1 | GHSA-34mp-hr4q-qvh5 | 2026-08-16 | setup.py install-command override; exfil of IP + username; classified PROBABLY_PENTEST |

OpenSSF malicious-packages classified this as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign — the recurring pattern where a bug-bounty researcher or a red-team engagement drops a dependency-confusion demonstration on PyPI to prove a namespace is reachable. The technique itself is real: subclass setuptools.command.install.install in setup.py, override run() to fire off an HTTP callback with socket.gethostname() + getpass.getuser(), then chain to the standard install.run(self). Because the override lives in the source distribution's setup.py, pip install kb-ai runs it — pip install --only-binary=:all: kb-ai does not, because the malicious code lives in the sdist and no wheel is available.

Source hash from the OpenSSF advisory: edd64785c168e513c50673e9b031048ba592c1460a9a952f9430feb83bf5042d.

Registry state

Both packages remain removed from npm and PyPI respectively. Private mirrors that pinned the versions before takedown will still resolve them; see the mirror-audit note in the recommendations.

Related tracked activity

• AI-agent scope naming-canary series: @ai-vertical/ai-agent continues the pattern of typosquat / naming-canary attacks against LLM tooling namespaces seen in 08-14 @guangnao/agent-proxy (Claude/Codex credential monetiser) and 08-15 @velliajs/discord (discord.js impersonator with kill-switch).
• OpenSSF PROBABLY_PENTEST PyPI dep-confusion series: kb-ai is another entry in the same operator-class as @mexc/shared-utils (08-14) — bug-bounty demonstrations that prove a namespace is reachable without shipping a real payload. Track separately from real supply-chain attacks; the risk is the reused primitive, not the specific demo.

Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages. No named threat actor.

Affected packages (2)

Impact

• @ai-vertical/ai-agent (npm, 2 versions): GHSA-3248-8gvm-g9jv, published 2026-08-17. Advisory carries only the standard "any computer with this package installed should be considered fully compromised" boilerplate - no source available, no per-package IOC. AI-adjacent scope name (@ai-vertical) suggests naming-canary targeting the LLM tooling ecosystem. Treat as arbitrary malware capable of full-control install-time execution until an IOC is published
• kb-ai (PyPI, 2 versions): GHSA-34mp-hr4q-qvh5, published 2026-08-16. OpenSSF-tagged PROBABLY_PENTEST (campaign GENERIC-standard-pypi-install-pentest). setup.py overrides the install command class to run malicious code during pip install; the payload exfiltrates basic host telemetry (IP, username) and is labelled as a dependency-confusion demonstration. Impact is limited (no persistence, no credential harvest) but the install-time RCE primitive is real - a reused primitive by a less-restrained operator could ship an actual payload the same way

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for the two package names below
2. 2For @ai-vertical/ai-agent matches (npm): uninstall and treat the install host as compromised until a specific IOC surfaces - the generic-malware boilerplate on the GHSA advisory means the reviewer confirmed harmful behavior but did not publish a payload description. Rotate anything the install host could reach and reimage if the machine is a build runner. Correct to your intended AI-agent tooling package
3. 3For kb-ai matches (PyPI): uninstall from any Python virtualenv, .venv, or system site-packages that ever ran pip install. The setup.py install-command override runs during install, so no ongoing runtime hook to kill - just remove the package. Because the exfil is only host telemetry, no credential rotation is strictly required, but if you are running an internal PyPI mirror that resolved kb-ai at pinned 0.1.0/0.1.1, treat it as a dep-confusion training-target hit and audit the mirror's resolution order
4. 4For all pip install and npm install runs in CI, respect the standard hardening: --no-build-isolation off (the default), --only-binary=:all: where possible for pip to skip setup.py execution, and --ignore-scripts for npm as defence-in-depth. The setup.py override in kb-ai is NOT mitigated by --ignore-scripts (that flag is npm-side); only pip install --only-binary=:all: avoids executing the malicious install command class
5. 5Verify neither package still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-3248-8gvm-g9jv - @ai-vertical/ai-agent (generic-malware boilerplate)

  github.com
  GitHub
• GHSA-34mp-hr4q-qvh5 - kb-ai (PyPI OpenSSF PROBABLY_PENTEST setup.py install-command demo)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• GitHub Advisory Database - recent pip malware advisories

  github.com
  GitHub