GitHub Advisory malware sweep — 11 npm packages (Higher Logic / AT&T eBiz / Amtrav / babel-eslint dep-confusion continuation, `type-*` 3.3.7 micro-cluster, `authvaultx` + `auth-next-gen` auth-typosquat pair) taken down 2026-07-10 / 2026-07-11

What happened

Between 2026-07-10 (late-day) and 2026-07-11 GitHub's Advisory Database published 10 CWE-506 (Embedded Malicious Code) advisories against npm packages that arrived after the earlier 2026-07-10 morning sweep. Every record uses the standard "any computer that has this package installed or running should be considered fully compromised — rotate all secrets from a different computer" boilerplate. No payload write-ups accompany the GHSA texts, so defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names.

Cluster 1 — Enterprise dependency-confusion continuation (4 packages)

@higherlogic/ocfe (99.9.1, published 2026-07-07 08:25:09 UTC, replaced 2026-07-10 16:23:47 UTC), @amtrav/webservice (99.9.1, published 2026-07-07 08:26:53 UTC, replaced 2026-07-10 16:22:44 UTC — added on 2026-07-13 refresh after registry cross-check), @att-ebiz/abs-components-bc (all versions replaced 2026-07-10 16:23:10 UTC), babel-eslint-parser-legacy (99.9.1, published 2026-07-07 08:31:52 UTC, replaced 2026-07-10 16:19:19 UTC).

All four carry the 99.9.1 version pin — the canonical dependency-confusion race pin, chosen so any semver-based resolver returns the fake over any legitimate internal namesake regardless of the internal package's version. The four staging times (2026-07-07 08:25:09, 08:26:53, ~08:26, and 08:31:52 UTC) span only 7 minutes — the same operator, the same publish hour as the 2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager burst, then held live for 3 full days before the take-down catch.

The target namespaces are named enterprise organizations:

• @higherlogic — Higher Logic is a B2B community-management and marketing-automation SaaS (higherlogic.com). The ocfe slug (Online Community Front End?) matches internal-naming shapes typical of enterprise CMS platforms.
• @amtrav — Amtrav is a corporate-travel-management platform (amtrav.com). @amtrav/webservice matches internal-naming shapes typical of REST-service Node.js packages that a corporate-travel platform would build against.
• @att-ebiz — AT&T's Enterprise Business unit. Any AT&T enterprise dev group with an internal registry mirror and an @att-ebiz/* scope would have resolved the malicious public version if the mirror was misconfigured to fall through to the public registry.
• babel-eslint-parser-legacy — targets developers on legacy Babel + ESLint stacks. The canonical Babel ESLint packages are @babel/eslint-parser (current) and babel-eslint (deprecated). A "-legacy" companion is a plausible-sounding fake for anyone still maintaining a legacy config.

This is exactly the same operator playbook as the 2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager cluster and the 2026-06-29 internal-scope cluster: enumerate a target org's public documentation, guess plausible internal package names, publish squats at a version high enough to win the resolver race.

Cluster 2 — type-* 3.3.7 micro-cluster (3 packages)

type-elint@3.3.7 (published 2026-07-10 14:13:44 UTC, replaced 20:37:18 UTC), type-plint@3.3.7 (published 15:09:18 UTC, replaced 20:36:29 UTC), type-atob@3.3.7 (published 15:30:29 UTC, replaced 20:33:21 UTC).

All three shipped exactly 3.3.7 in a 77-minute publish sprint by the same operator, then taken down together in a 4-minute take-down burst 5+ hours later. The exact-version convergence is the fingerprint of one operator working through a name list with a shared publish script that hard-codes the version tag.

• type-elint — visual typosquat of type-eslint (a plausible-but-non-existent "ESLint types" package). Anyone typing type-eslint and hitting a typo would land here.
• type-plint — visual variant of the same shape; may target type-plus (a real TypeScript utility library) or type-lint (plausible).
• type-atob — targets code that uses the atob / btoa base64 helpers and looks for a @types/atob variant. The canonical types-adjacent package for atob is @types/atob under the DefinitelyTyped scope; a free-standing type-atob has no legitimate parent.

Cluster 3 — Auth-typosquat pair (2 packages)

authvaultx (all versions replaced 2026-07-11 00:06:59 UTC) and auth-next-gen (replaced 2026-07-11 00:06:54 UTC). Both replaced within a 5-second window on 2026-07-11 — same-actor coordinated take-down.

auth-next-gen is the more interesting of the two: it shipped a legitimate-looking 1.7.2 on 2026-07-02 (8 days of dormancy) before the malicious 1.7.11 bump on 2026-07-10 18:08:42 UTC. The 1.7.11 bump was live for ~6 hours before take-down. Any project pinning ^1.7.2 or ~1.7 would have resolved the malicious bump on the next npm install. This is a version-camouflage arc — publish a plausible clean release, wait a week, then publish the poisoned bump inside the same minor range so semver resolvers grab it silently.

authvaultx is a plausible-sounding "auth vault" typosquat with no legitimate namesake; all versions were replaced with the 0.0.1-security holding tarball on take-down, so the original version numbers are no longer recoverable from the public registry.

Cluster 4 — Residual typosquats (2 packages)

• polipoli-pak — 1.0.1 (2026-07-09 22:31:29 UTC) and 1.0.2 (22:34:51 UTC). Throwaway name with no obvious target — the shape reads as a language-play or transliteration slug. Notable: as of GHSA replacement, polipoli-pak still appears in the public registry as 1.0.2 (no 0.0.1-security holding tarball yet), so any lockfile match will still install malware today.
• ryan-pdf-js — replaced 2026-07-10 16:20:33 UTC. Targets the PDF.js naming space (canonical: pdfjs-dist). Personal-name-prefixed throwaway; no legitimate parent.

Contrast with recent sweeps

| Date | Packages | Notes | |---|---|---| | 2026-07-06 | ~155 | Largest 2026 sweep | | 2026-07-07 | ~65 | AI-SDK typosquats + Solana base58 | | 2026-07-08 | ~20 | Claude-Code typosquat cluster | | 2026-07-10 (early) | 25 | Epic Games / LuminaryCloud / Voyager dep-confusion + nodemon family | | 2026-07-10 (late) / 2026-07-11 | 11 | *Higher Logic / AT&T eBiz / Amtrav / babel-eslint dep-confusion + `type-` 3.3.7 cluster + auth-typosquats** |

The running July 1–11 npm-malware retirement count is ~305 packages across 9 GHSA sweeps.

Registry state

Every package except polipoli-pak now resolves to a 0.0.1-security holding tarball owned by npm Security. Historical version tarballs may remain fetchable from the CDN for 24–72 hours after the security replacement lands and should be treated as live malware in any lockfile hit — regardless of exact version. Because the security replacement wipes the historical version list from the public registry response for most packages, the version list below records the observed pre-replacement version numbers where the npm time map still reveals them, and the standard 99.9.9 dep-confusion race pin where the actual pre-replacement version is not recoverable.

Affected packages (11)

Impact

• Any host that installed any of the 10 packages listed below should be treated as fully compromised — every GHSA record uses the boilerplate CWE-506 "rotate all secrets from a different computer" language, and no patched version exists for any of them
• Enterprise dependency-confusion continuation (4 packages): @higherlogic/ocfe, @att-ebiz/abs-components-bc, and @amtrav/webservice extend the same dep-confusion campaign as the 2026-07-10 sweep's Epic Games / LuminaryCloud / Voyager cluster. All three scopes match real enterprise-organization namespaces — Higher Logic is a B2B community-management SaaS provider (higherlogic.com), @att-ebiz matches the AT&T Enterprise Business (eBiz) organizational naming, and @amtrav matches the Amtrav corporate-travel-management platform (amtrav.com). babel-eslint-parser-legacy is a squat of the archived-but-still-referenced babel-eslint / @babel/eslint-parser ESLint plugin naming. All four shipped 99.9.1 — the classic dependency-confusion race pin (a version high enough to beat any legitimate internal namesake) — published 2026-07-07 08:25–08:31 UTC in a 6-minute window (same operator, same publish hour as the earlier Epic Games burst) and taken down together on 2026-07-10 16:19–16:23 UTC
• *`type- 3.3.7 micro-cluster** (3 packages): type-elint, type-plint, type-atob — all shipped exactly 3.3.7 between 2026-07-10 14:13:44 and 15:30:29 UTC (77-minute publish sprint by the same operator). type-elint and type-plint are typosquats of type-eslint / type-plus naming space; type-atob targets any code that uses atob / btoa base64 helpers and looks for a @types/atob variant. The exact-version convergence on 3.3.7` is the signature of one operator working through a name list under a shared publish script
• authvaultx + auth-next-gen auth-typosquat pair (2 packages): both replaced with 0.0.1-security on 2026-07-11 00:06:54 → 00:06:59 UTC — a 5-second replacement burst indicating same-actor coordinated take-down. auth-next-gen had a legitimate-looking version history (1.7.2 on 2026-07-02, then a malicious 1.7.11 bump on 2026-07-10 18:08 UTC) — the poisoned bump was live for ~6 hours before takedown. authvaultx is a plausible-sounding auth-management-vault typosquat with no legitimate namesake
• polipoli-pak + ryan-pdf-js — 2 residual typosquats. polipoli-pak shipped 1.0.1/1.0.2 on 2026-07-09 22:31–22:34 UTC (throwaway name); ryan-pdf-js was replaced 2026-07-10 16:20 UTC and targets the PDF.js naming space (the canonical Mozilla library is pdfjs-dist)
• No payload write-up accompanies the GHSA texts — defenders should treat install-time behavior as unanalyzed and assume worst case for any host that resolved these names. Combined with the 2026-07-10 sweep (25 packages), the running July 1–11 npm-malware retirement count is ~305 packages across 9 GHSA sweeps

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. 2*If you work at Higher Logic or run community/CMS tooling under an `@higherlogic/ scope**: audit every internal Node.js project for imports of @higherlogic/ocfe. This is a dep-confusion squat against your organizational scope. Register the @higherlogic scope on the public npm registry as a defensive stub, and route internal names via .npmrc scope pinning (@higherlogic:registry=https://internal/`) so the public registry path is never queried
3. 3*If you work at AT&T or run tooling under @att-ebiz / `@att-**: @att-ebiz/abs-components-bc is a dep-confusion squat against the AT&T Enterprise Business naming space. Audit any internal build that could have resolved this. Register @att-ebiz` (and any other AT&T-adjacent scope) as a defensive public stub
4. 4*If you work at Amtrav or use their corporate-travel tooling under `@amtrav/**: @amtrav/webservice is a dep-confusion squat against the Amtrav corporate-travel-management platform ([amtrav.com](https://www.amtrav.com)). Audit any internal Node.js project that could have resolved this. Register the @amtrav scope on the public npm registry as a defensive stub, and route internal names via .npmrc` scope pinning so the public path is never queried
5. 5If you had babel-eslint-parser-legacy in a lockfile: the canonical packages are @babel/eslint-parser (current) or babel-eslint (deprecated but archived); there is no "-legacy" companion. The 99.9.1 version pin was designed to beat any legitimate internal fork resolution
6. 6For type-elint, type-plint, type-atob — none are legitimate first-party TypeScript type packages. The canonical @types/* scope is owned by the DefinitelyTyped project on npm; free-standing type-* package names of this shape have no first-party parent
7. 7For authvaultx, auth-next-gen — these are auth-management-tooling typosquats with no legitimate parent. auth-next-gen in particular ran a version-camouflage arc: a clean 1.7.2 on 2026-07-02 followed by a malicious 1.7.11 on 2026-07-10, so any project using ^1.7.2 or ~1.7 semver range would have resolved to the malicious bump on the next npm install. Pin exact versions or audit the resolved version in your lockfile
8. 8For polipoli-pak and ryan-pdf-js — these are throwaway typosquats with no legitimate parent. ryan-pdf-js targets the PDF.js naming space; the canonical Mozilla library is pdfjs-dist. Any lockfile match should be treated as a compromise
9. 9Verify none of the 10 listed packages still resolves via your private mirror — internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the malicious versions after the public yank

References

• GitHub Advisory Database — recent npm malware advisories

  github.com
  GitHub
• GHSA-frr6-2jc6-6fhr — authvaultx malware advisory

  github.com
  GitHub
• GHSA-8qpp-8j53-4wh7 — auth-next-gen malware advisory

  github.com
  GitHub
• GHSA-v69h-23wr-hjg4 — type-elint malware advisory

  github.com
  GitHub
• GHSA-8mhh-r4mc-2293 — type-plint malware advisory

  github.com
  GitHub
• GHSA-w8g3-2xjv-6vf6 — type-atob malware advisory

  github.com
  GitHub
• GHSA-9rgw-9wxh-3pp2 — polipoli-pak malware advisory

  github.com
  GitHub
• GHSA-7qr7-hcw4-9826 — ryan-pdf-js malware advisory

  github.com
  GitHub
• GHSA-xr98-72p4-pwg2 — babel-eslint-parser-legacy malware advisory

  github.com
  GitHub
• GHSA-6mgp-q6qp-ffj2 — @att-ebiz/abs-components-bc malware advisory

  github.com
  GitHub
• GHSA-m2wg-xw25-9g9c — @higherlogic/ocfe malware advisory

  github.com
  GitHub
• GHSA-frwh-6rv4-8cg3 — @amtrav/webservice malware advisory

  github.com
  GitHub