GHSA-flagged malware brands — 16 autotel-*, 4 awaitly-*, and `ai-sdk-ollama` packages (Nov 2025–Jun 2026) marked embedded-malicious-code on 2026-06-29/30

What happened

On 2026-06-29 and 2026-06-30 GitHub's Advisory Database dropped 21 CWE-506 malware records against npm packages that had been sitting on the public registry as maintained "brand" packages for anywhere from 4 to 7 months. Every listed advisory covers every published version of the named package — the whole brand is flagged, not a single compromised release.

autotel-* — a fake OpenTelemetry auto-instrumentation family

The autotel brand launched on npm on 2025-11-26 with autotel-web, autotel-plugins, autotel-mcp, autotel-subscribers, and autotel-backends, and grew to 16 packages by June 2026: autotel-cli, autotel-hono, autotel-sentry, autotel-vitest, autotel-playwright, autotel-tanstack (Dec 2025 – Feb 2026), then autotel-mongoose, autotel-drizzle, autotel-mcp-instrumentation, autotel-eventcatalog, and autotel-pact (March–May 2026). Each package presents itself as OpenTelemetry auto-instrumentation for a specific runtime or framework — a plausible cover story that lines up with the real @opentelemetry/auto-instrumentations-* and @opentelemetry/instrumentation-* scoped packages.

Version cadence is uncharacteristic of a solo weekend project: autotel-subscribers reached v41.0.2 (97 releases), autotel-mcp reached v29.0.1 (74 releases), autotel-plugins reached v0.19.36 (67 releases). Fast SemVer churn on unrelated packages under one brand is a common pattern for building download-count credibility before a payload gets flipped.

awaitly-* — promise + database utility brand

The awaitly brand launched 2026-01-16 with awaitly@1.0.0, then expanded to awaitly-analyze (2026-01-22), awaitly-mongo (2026-01-27), and awaitly-libsql (2026-01-28). The main awaitly reached v1.34.0 across 42 releases; each database variant reached v22+ / v23+ majors across 44–52 releases. The absurdly high majors are the same dep-confusion-resolution tactic used by the 2026-06-29 internal-scope 99.9.1 batch (@deel-ui/animation, @webda-infra-ui/static-images), scaled down: any internal build looking up an unpinned awaitly-mongo name would resolve to the malware brand's v24.0.0 over a plausible v1.x / v2.x internal release.

ai-sdk-ollama — Vercel AI SDK Ollama provider typosquat

ai-sdk-ollama (55 versions since 2025-08-06) squats on the naming space of Vercel's ai SDK provider packages. The legitimate name is ollama-ai-provider; the malware flips the noun order to grab autocomplete drift. v4.0.0-beta.0 and multiple v3.x majors give the package a "mature" look for developers browsing releases.

GHSA attribution and payload

The advisories do not include a payload write-up or attribution. GitHub's standard boilerplate ("rotate all secrets from a different computer") is the only guidance. Given the length of the exposure window and the pattern-match to prior maintainer-takeover and long-tail-typosquat campaigns (nrwl.angular-console, @cap-js/*, @tanstack/*), defenders should assume the payload accessed credential material typical of an npm-lifecycle credential stealer (npm publish tokens, cloud IMDS, HashiCorp Vault, GitHub OIDC).

Disclosure timeline

• 2025-08-06 — ai-sdk-ollama first published.
• 2025-11-26 — autotel-web, autotel-plugins, autotel-mcp, autotel-subscribers, autotel-backends first published.
• 2025-12-03 — autotel-tanstack first published.
• 2026-01-16 – 2026-01-28 — awaitly, awaitly-analyze, awaitly-mongo, awaitly-libsql first published.
• 2026-02-11 – 2026-02-14 — autotel-hono, autotel-sentry, autotel-vitest, autotel-playwright first published.
• 2026-03-24 — autotel-mongoose, autotel-drizzle first published.
• 2026-04-15 — autotel-mcp-instrumentation first published.
• 2026-05-24 – 2026-05-29 — autotel-eventcatalog, autotel-pact first published.
• 2026-06-29 — GitHub Advisories drops CWE-506 records for autotel-cli, autotel-backends.
• 2026-06-30 — Batch expansion covers the remaining autotel-* packages, all four awaitly* packages, and ai-sdk-ollama.

Affected packages (21)

Impact

• The GHSA text on every advisory in this batch says "any computer that has this package installed or running should be considered fully compromised" — treat any host that ever installed one of these as breached and rotate credentials from a separate clean device
• Unlike a same-day typosquat push, these brands ran for 4–7 months (autotel-* since 2025-11-26, awaitly since 2026-01-16) collecting downloads before the advisory dropped — the exposure window is long and pre-yank installs may already have executed the payload
• autotel-* masquerades as OpenTelemetry auto-instrumentation for popular stacks (TanStack, Vitest, Playwright, Sentry, Hono, Drizzle, Mongoose, MCP, Pact, EventCatalog); ops engineers wiring up traces are the natural victim profile
• awaitly-* masquerades as promise-timeout / async-flow utilities with database-flavour variants (-mongo, -libsql); the very high v22.0.0 / v23.0.0 majors were used to backstop dep-confusion resolution against any plausible internal SemVer
• ai-sdk-ollama typosquats the Vercel ai SDK's official Ollama provider, targeting developers who Copilot-autocomplete import { ollama } from "ai-sdk-ollama" instead of the real name

What to do

1. 1Remove every autotel-*, awaitly*, and ai-sdk-ollama reference from package.json, lockfiles, CI image layers, and committed node_modules
2. 2For OpenTelemetry auto-instrumentation, use the official @opentelemetry/auto-instrumentations-* scoped packages — never the flat autotel-* slugs
3. 3For async utilities, prefer built-in Promise.withResolvers() / AbortSignal.timeout() (Node 20+) or well-known packages like p-timeout; the awaitly* naming space is entirely attacker-controlled
4. 4For Ollama with the Vercel AI SDK, use the official provider ollama-ai-provider (or the framework's built-in provider) — the specific flat name ai-sdk-ollama is the malware slot
5. 5If you ever pinned any version of any listed package: treat the runtime and any artefact it produced as compromised, and audit your CI cache history and internal npm mirror for the specific tarball hashes

References

• GHSA-mhh3-45v6-6vmh — autotel-tanstack malware advisory

  github.com
  GitHub
• GHSA-7cv4-gfx4-2c3v — autotel-mcp-instrumentation malware advisory

  github.com
  GitHub
• GHSA-4vjc-qq25-pvc4 — autotel-mongoose malware advisory

  github.com
  GitHub
• GHSA-43fx-93g7-w27h — autotel-pact malware advisory

  github.com
  GitHub
• GHSA-fgj5-m9vh-ffjw — autotel-plugins malware advisory

  github.com
  GitHub
• GHSA-6pcg-qh3x-h5pg — autotel-playwright malware advisory

  github.com
  GitHub
• GHSA-rxgj-x3gg-2fg8 — autotel-sentry malware advisory

  github.com
  GitHub
• GHSA-37wr-f689-9c3c — autotel-subscribers malware advisory

  github.com
  GitHub
• GHSA-hhr2-ppwm-hgqr — autotel-drizzle malware advisory

  github.com
  GitHub
• GHSA-c2jx-wr8m-cv28 — autotel-hono malware advisory

  github.com
  GitHub
• GHSA-h58c-49hq-mq6c — autotel-eventcatalog malware advisory

  github.com
  GitHub
• GHSA-3wmg-66hp-xhv9 — autotel-mcp malware advisory

  github.com
  GitHub
• GHSA-3729-344x-9v28 — autotel-cli malware advisory

  github.com
  GitHub
• GHSA-9p9m-f2hg-9gxm — autotel-backends malware advisory

  github.com
  GitHub
• GHSA-c8c9-7f3h-7c76 — awaitly malware advisory

  github.com
  GitHub
• GHSA-4vpc-g7mx-4m5v — awaitly-mongo malware advisory

  github.com
  GitHub
• GHSA-hv34-4pjp-j28h — awaitly-analyze malware advisory

  github.com
  GitHub
• GHSA-j6m2-hp97-pv4j — awaitly-libsql malware advisory

  github.com
  GitHub
• GHSA-m9j7-x8ww-5jwr — ai-sdk-ollama malware advisory

  github.com
  GitHub