GitHub Advisory malware sweep — 20+ npm packages (chai-as-*, brock-*, rebrandly-*, dep-confusion + typosquat batch) taken down 2026-06-30

What happened

Between 2026-06-30 14:08 UTC and 16:17 UTC, GitHub's Advisory Database published a batch of roughly 25 malware advisories against npm packages that had been sitting on the registry for hours to months. All records use CWE-506 (Embedded Malicious Code) with the standard "any computer that installed or ran this package should be considered fully compromised — rotate all secrets from a different device" boilerplate. No payload write-up is included in the GHSA text for any of them, so defenders should treat the install-time behaviour as unanalysed and assume worst case.

Sub-cluster taxonomy

• Chai typosquats. chai-as-persisted and chai-as-assured fuse chai-as-promised (the go-to plugin for asserting on promises, ~5M weekly downloads) with plausible-sounding suffixes. Both packages ship two high-semver releases (4.2.8 / 6.1.9 and 6.0.4 / 7.1.2 respectively), matching the "pretend to be a mature package" tactic used by the June 26 pino-zod@1.0.121 typosquat.
• *`brock- pair.** brock-loader@1.9.9 and brock-react-alerts@1.99.99 / 9999.0.0 — the 9999.0.0 tag is the classic dependency-confusion resolution-winning SemVer used by the June 29 internal-scope batch (@deel-ui/animation, @citi-icg-171632/citicms-repo-component`).
• *`rebrandly-domains- pair.** Both rebrandly-domains-search-client@9999.0.0 and rebrandly-domains-digger@9999.0.0` — dependency-confusion squats against what looks like a Rebrandly-owned internal SDK scope for their URL-shortener / branded-domain product.
• Confluent Kafka client typosquat. confluent-kafka-javascript@0.0.1 — the legitimate name is scoped: @confluentinc/kafka-javascript. Attackers routinely publish the unscoped variant of a well-known scoped package.
• *`postcss- typosquat.** postcss-property-rollup@0.0.1 — extends the pattern already documented in the 2026-06-26 pump/pino/rollup sweep (rollup-plugin-polyfill-connect`) and the 2026-06-22 JFrog PostCSS-RAT campaign.
• terminal-prettier brand. 20+ published versions dating back to 2025-11 — this is a long-running typosquat "brand" (of prettier) rather than a same-day push. GHSA classifies the entire package as malware; any consumer that ever pinned any published version is in scope.
• ts-linting-builder@2.1.2 + ts-lint-builders-v2.1@2.1.0. Paired typosquats against tslint / ts-lint-plugin-* — the v2.1 suffix in the name is an unusual pattern that suggests they were designed to match a specific pinned version string in a CI script or Dockerfile.
• Standalone malicious names. rs-biginteger (6.1.3, 6.1.5), quoting (0.1.0), procwire (1.3.0, 2.0.0), endpointmap (2.1.0, 3.0.0), agent-starter-pack@0.0.1, setup-cicd@0.0.1, nbmolviz-js@0.0.1 — no obvious upstream target for these; likely low-volume standalone malware pushes that a security researcher flagged and reported together.

Overlap with existing DependencyWatch entries

• livekit-agents (also in this GHSA batch) is already tracked in the 2026-06-27 livekit-agents.xyz incident; this entry does not repeat those versions.
• chai-as-persisted is separately tracked in the 2026-06-27 chai-as-persisted-jsonspack incident for the 1.0.0 first-drop; the June 30 GHSA covers newly-visible 4.2.8 / 6.1.9 releases under the same package name.

Attribution

GitHub does not attribute the batch, and no single security vendor has published a research post as of 2026-07-01. The mix of dependency-confusion 9999.0.0 tags, typosquat semver drift, and long-lived "brand" packages suggests the batch is a triage of several unrelated reports processed on the same day, not one coordinated operator.

Affected packages (18)

Impact

• Any host that installed any of the listed packages should be treated as fully compromised — every GHSA record uses the standard "rotate all secrets from a different computer" language
• brock-react-alerts@9999.0.0 and both rebrandly-domains-search-client@9999.0.0 / rebrandly-domains-digger@9999.0.0 follow the internal-scope dependency-confusion playbook (matches the 2026-06-29 Deel/Webda/Citi cluster) — CI pipelines that resolve unscoped brock-* or rebrandly-domains-* names against the public registry would have pulled the malicious tarball instead of a private mirror release
• chai-as-persisted and chai-as-assured typosquat the widely-used chai-as-promised Chai plugin (~5M weekly downloads); dual name-fuse (persisted, assured — both plausible chai-adjacent slugs) suggests one operator hedging autocomplete drift
• confluent-kafka-javascript@0.0.1 typosquats Confluent's official @confluentinc/kafka-javascript client (dropped scope prefix) — targets Kafka producer / consumer environments where the maintainer might paste an unscoped name into package.json
• postcss-property-rollup@0.0.1 extends the ongoing postcss-* typosquat wave (see the 2026-06-22 JFrog PostCSS-RAT and 2026-06-26 pump/pino/rollup sweep)
• terminal-prettier shipped 20+ versions over several months, indicating a matured typosquat brand of the prettier code formatter rather than a one-off push

What to do

1. 1Remove every reference to any package listed in the packages map below from package.json, lockfiles, CI image layers, and committed node_modules
2. 2If your build ever resolved 9999.0.0 of brock-react-alerts, rebrandly-domains-search-client, or rebrandly-domains-digger against the public registry: treat the build runner and any artefact it produced as compromised — rotate every credential reachable from that runner from a separate clean device
3. 3Kafka pipelines: reinstall with the correct scoped name @confluentinc/kafka-javascript; the flat name confluent-kafka-javascript is the malware slot
4. 4Postcss users: audit for postcss-property-rollup in lockfiles; the legitimate slug is either postcss (core) or a specific first-party plugin under the postcss-* scope
5. 5Rebrandly users: internal builds should route the rebrandly-* scope to your private mirror only — the public-registry names are now unpublished but the campaign pattern continues
6. 6Verify none of the listed packages resolves via your private mirror — many internal Artifactory / Nexus / Verdaccio instances cache npm tarballs and will continue to serve the malicious version after the public yank

References

• GitHub Advisory Database — recent npm malware advisories

  github.com
  GitHub
• GHSA-xm5w-w96q-42f3 — rs-biginteger malware advisory

  github.com
  GitHub
• GHSA-x8q6-66jr-wmp3 — quoting malware advisory

  github.com
  GitHub
• GHSA-4wm6-vmww-2544 — chai-as-persisted malware advisory

  github.com
  GitHub
• GHSA-m282-3m8c-qjwj — chai-as-assured malware advisory

  github.com
  GitHub
• GHSA-gh2m-x2qr-m2cm — brock-react-alerts malware advisory

  github.com
  GitHub
• GHSA-gwv3-x257-r43c — brock-loader malware advisory

  github.com
  GitHub
• GHSA-6q7q-73w8-xvcf — rebrandly-domains-search-client malware advisory

  github.com
  GitHub
• GHSA-44wx-4683-p2h3 — rebrandly-domains-digger malware advisory

  github.com
  GitHub
• GHSA-x676-qqgj-qfgg — agent-starter-pack malware advisory

  github.com
  GitHub
• GHSA-5rc3-r829-w347 — setup-cicd malware advisory

  github.com
  GitHub
• GHSA-fc4r-p4fh-6h4p — nbmolviz-js malware advisory

  github.com
  GitHub
• GHSA-6g2x-2f5c-wp9w — postcss-property-rollup malware advisory

  github.com
  GitHub
• GHSA-j28m-58xp-3wgh — confluent-kafka-javascript malware advisory

  github.com
  GitHub
• GHSA-8mpj-272v-jhv7 — ts-linting-builder malware advisory

  github.com
  GitHub
• GHSA-vjgf-xg3j-g9c5 — ts-lint-builders-v2.1 malware advisory

  github.com
  GitHub
• GHSA-m8cr-hv9p-pg3f — terminal-prettier malware advisory

  github.com
  GitHub
• GHSA-5r42-357x-f2mx — procwire malware advisory

  github.com
  GitHub
• GHSA-p3qr-5g48-8w89 — endpointmap malware advisory

  github.com
  GitHub