DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 29 Jul 202665 packages · 77 versions

GitHub Advisory npm CWE-506 sweep - 60-package 2026-07-28 → 2026-07-29 backfill (9-package `@wagni_bot/*` Telegram credential-stealer scope, 6-package `2.1.6` postinstall SSH-key + file harvester cluster, 4-package `streak-*` Windows PE binary drop, 3-package `aone-*` embedded-malware trio, `xerohub-discord-voice` Discord-token stealer pair, generic-name C2 domain communicator kit, `@joyfill/*` prerelease pair, misc single-package RATs and typosquats)

Summary

GitHub Advisory Database published 6 new npm CWE-506 advisories on 2026-07-29 plus a ~55-package 2026-07-28 backfill. Clusters: @wagni_bot/* 9-pkg Telegram stealer, 2.1.6 SSH-key harvester (app-*-layer, api-*-sdk), streak-* Windows-PE dropper, aone-* all-versions, xerohub-discord-voice token stealer, generic-name C2 kit.

typosquatcrypto-wallet-draincredential-theftinfostealerdependency-confusionci-cd-compromiseobfuscation
Detected by
GitHub Advisory Database · OpenSSF Package Analysis · npm Security
Also known as
2026-07-28 GHSA npm backfill batch · @wagni_bot Telegram credential stealer scope · 2.1.6 SSH-key harvester cluster · streak-* Windows PE dropper
Ecosystems
npm
Packages tracked
65

What happened

On 2026-07-28 and 2026-07-29, the GitHub Advisory Database published a further ~60 new npm CWE-506 (Embedded Malicious Code) advisories - 6 dated 2026-07-29 (chain-manager, chain-analyze, @bowozzz/baileys, blots, @mypwn/hawkeye, toll_free) plus a ~55-package 2026-07-28 backfill batch that appeared after the prior day's npm-2026-07-28-ghsa-malware-sweep module was authored. This module catalogues both.

The 07-28 backfill has clear operator-cluster structure - same version pins, same-scope publish signatures, same C2 patterns - indicating three coordinated multi-package campaigns and one broad OpenSSF Package Analysis auto-triage sweep, rather than 55 unrelated hobbyist typosquats.

Cluster A - @wagni_bot/* Telegram credential-stealer scope (9 packages, all 1.0.0, 2026-07-28)

| Package | Notes | |---|---| | @wagni_bot/web3 | web3.js SDK impersonation | | @wagni_bot/wagni | scope-root brand impersonation | | @wagni_bot/polygon | Polygon SDK impersonation | | @wagni_bot/opensea | OpenSea SDK impersonation | | @wagni_bot/hyperliquid | Hyperliquid SDK impersonation | | @wagni_bot/polymarket | Polymarket SDK impersonation | | @wagni_bot/metamask | MetaMask SDK impersonation | | @wagni_bot/eth | Ethereum SDK impersonation | | @wagni_bot/bsc | BSC / BNB Chain SDK impersonation |

All 9 use identical postinstall payloads: fingerprint the host, search ~/, exfil SSH keys + cryptocurrency wallet files + ~/.env + ~/.git-credentials to a single hardcoded Telegram bot token. Every advisory's "Details" section explicitly cross-references a 25-package @wagni_bot scope operator that originally published on 2026-07-09 - the 9 catalogued here are the ones GHSA formalised on 2026-07-28. Identical payload files and unified C2 across all 25 confirmed by the advisory research.

Cluster B - 2.1.6 postinstall SSH-key + file harvester (6 packages, all = 2.1.6, 2026-07-28)

| Package | Notes | |---|---| | app-svm-layer | scope name suggests Solana Virtual Machine layer | | app-sima-layer | scope name suggests SIMA runtime layer | | app-sim-layer | scope name suggests SIM layer | | app-soda-layer | scope name suggests SODA layer | | api-node-sdk | generic Node SDK impersonation | | api-rust-sdk | generic Rust SDK impersonation |

Every postinstall hook: (a) writes an attacker SSH public key to ~/.ssh/authorized_keys on Linux / macOS; (b) opens SSH-port firewall rules (ufw allow 22, iptables INPUT accept); (c) recursively walks ~/ matching id.json, config.toml, .env*, *.pem, Solana / Sui / Sei keypair files; (d) POSTs the harvested files + host metadata over plaintext HTTP to 95.216.118.146 on TCP 3000 and 3001. Behaviour + identical 2.1.6 version-pin across 6 packages is a single-operator signature - probable coordinated Solana-adjacent SDK-impersonation campaign.

Cluster C - streak-* Windows PE binary dropper + WSL escalation (4 packages, all 1.0.0, 2026-07-28)

| Package | Notes | |---|---| | streak-core-lib | drops vite-native-helper.exe | | streak-core-math | fetches + executes hex-encoded binary | | streak-daily-lib | WSL-to-Windows privilege escalation | | lib-streak-math | Linux daemon + Windows Startup dual-persistence |

Each masquerades as a "day-math primitives" library; on import the module extracts (or fetches) a Windows PE binary and deposits it into the user's %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup folder - persistent execution at every logon. streak-daily-lib uniquely calls out to powershell.exe from inside a WSL session, achieving WSL→Windows cross-boundary privilege escalation. lib-streak-math supports both Windows and Linux targets with a detached background daemon on Linux.

Cluster D - aone-* all-versions embedded malware (3 packages, >= 0, 2026-07-28)

| Package | Notes | |---|---| | aone-kit | all versions | | aone-kit-cli | all versions | | aone-sandbox | all versions |

Same-scope coordinated publish with the boilerplate CWE-506 disclosure text and no functional legitimate code. The aone-* naming strongly hints at Alibaba's internal Aone DevOps / build platform - likely dep-confusion probes against Alibaba internal-lib names. Treat the whole scope as attacker-owned.

Cluster E - xerohub-discord-voice-v2/v3 Discord token stealer pair (2 packages, 2026-07-28)

| Package | Versions | Notes | |---|---|---| | xerohub-discord-voice-v2 | 1.8.0 | POST Discord token → hardcoded webhook | | xerohub-discord-voice-v3 | 3.0.0, 3.0.2, 3.0.3 | same theft path, three versions |

On any call to the exported startVoiceJoiner(config) function, the code POSTs USER_TOKEN, USER_TOKEN_2, VOICE_SERVER_ID, and VOICE_CHANNEL_ID via axios to a hardcoded discord.com/api/webhooks/... URL owned by the package author. All axios errors are deliberately swallowed to hide the theft from the caller.

Cluster F - generic-name C2 domain communicator kit (7 packages, 2026-07-28)

| Package | Version | Notes | |---|---|---| | num-format-helper | 1.0.0 | OpenSSF PA: "communicates with malicious domains" | | string-format-kit | 1.0.2 | same signature | | date-sanitize-helper | 1.0.0 | same signature | | json-to-table-util | 1.0.0 | same signature | | array-sort-helper | 1.0.0 | same signature | | color-convert-helper | 1.0.0 | AWS IAM cred harvest + internal-net recon | | simple-probe-utils | 1.0.1 | AWS IAM + cloud metadata exfil |

All 7 flagged with near-identical OpenSSF Package Analysis triggers within the same day. Names deliberately generic to blend with legitimate utility libraries. The two with more specific behaviour analysis (color-convert-helper, simple-probe-utils) both do cloud IAM credential theft - consistent with the rest of the cluster likely doing the same behind the boilerplate description.

Cluster G - @joyfill/* prerelease-tag pair (2 packages, 2026-07-28)

| Package | Version | Notes | |---|---|---| | @joyfill/layouts | 0.1.2-2773.beta.0 | unusual prerelease tag | | @joyfill/components | 4.0.0-rc24-2773-beta.4 | unusual rc24 + 2773 prerelease tag |

Coordinated same-scope publish under prerelease version tags. The 2773 numeric signature is present in both - a strong shared-operator indicator. Prerelease-tag hijacks slip past npm install when --prefer-online is set or when a lockfile explicitly pins a beta.

Cluster H - miscellaneous single-package RATs and typosquats (22 packages, 2026-07-28)

See the packages map below for the complete list with versions. High-signal picks: parallely@10.0.3 (concurrently typosquat, platform-specific dropper); ethers-secure@1.0.0 (ethers.js typosquat, private-key exfil on wallet-function call); @ai_/autoprefixers@1.2.0 (autoprefixer typosquat with underscore-prefix + trailing-s); @apexfnd/apex@1.0.0/1.0.1 (root-priv postinstall on macOS); @yancyyu/agentcli@1.9.32 (Lark/Feishu keychain-credential exfil - Chinese-enterprise-tooling target); @crbrc/xbt@1.1.0-1.1.4/1.2.1 (OxaPay payment-credential exfil + TCP backdoor relay); bianira-ui@1.27.0 and fluid-type-ui@2.0.8 (both use blockchain-based C2 resolution - Ethereum contract lookup for the payload URL); react-puller@1.0.0 (Windows registry persistence - Run key modification).

Cluster I - all-versions generic-name credential stealers (5 packages, 2026-07-28, >= 0)

postcss-motion-utils, local-config-parser, lib-mtop, cloud-config-fetcher, smart-config-manager. All 5 flagged all-versions with the boilerplate CWE-506 disclosure. The cloud-config-fetcher + smart-config-manager naming pattern reads as dep-confusion targeting a Java/Spring internal-lib namespace but published to npm - check whether your build resolves those names cross-ecosystem.

2026-07-29 OpenSSF Package Analysis batch (6 packages)

| Package | Version | Notes | |---|---|---| | chain-manager | all versions | OpenSSF PA CWE-506 | | chain-analyze | all versions | follow-up to 07-28 1.0.2 disclosure (GHSA-gqcp-j8hr-w48x); both versions catalogued below | | @bowozzz/baileys | all versions | @whiskeysockets/baileys scope typosquat via bowozzz | | blots | 2.1.0 | OpenSSF PA generic malicious-command trigger | | @mypwn/hawkeye | 99.0.0 | dep-confusion-style inflated major version | | toll_free | 1.0.1 | OpenSSF PA generic malicious-command trigger |

Registry state

All 60 packages security-replaced with 0.0.1-security sentinel tarballs during the 2026-07-28 / 2026-07-29 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

  • Extends npm-2026-07-28-ghsa-malware-sweep (54 packages), which catalogued the initial 2026-07-27 → 2026-07-28 batch before this backfill appeared.
  • The Solana-keypair harvest behaviour in Cluster B echoes multi-2026-06-12-solana-fakefix-jfrog and npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie - the plaintext HTTP C2 at 95.216.118.146 is not attributed to a named actor in the GHSA advisories, so no threatActor field is set.

Affected packages (65)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Any host that installed any of the 60 npm packages listed below should be treated as fully compromised - every GHSA record uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
  • *Cluster A - `@wagni_bot/ Telegram credential-stealer scope** (9 packages, all 1.0.0, all published 2026-07-28): @wagni_bot/web3, @wagni_bot/wagni, @wagni_bot/polygon, @wagni_bot/opensea, @wagni_bot/hyperliquid, @wagni_bot/polymarket, @wagni_bot/metamask, @wagni_bot/eth, @wagni_bot/bsc. Every package fingerprints the host on postinstall, harvests SSH keys / cryptocurrency wallet files / ~/.env / ~/.git-credentials, and exfiltrates to a hardcoded Telegram bot token - one operator, identical payloads across all 9 with unified C2. Advisory text explicitly attributes to a 25-package @wagni_bot` scope campaign that first published 2026-07-09; the 9 covered here are the ones GHSA formalised on 2026-07-28
  • Cluster B - 2.1.6 postinstall SSH-key + file harvester (6 packages, all published 2026-07-28 with the identical = 2.1.6 version signature): app-svm-layer, app-sima-layer, app-sim-layer, app-soda-layer, api-node-sdk, api-rust-sdk. Every postinstall hook installs an attacker SSH public key, opens SSH-port firewall rules, harvests id.json / config.toml / .env* / Solana keypair files, and exfiltrates over plaintext HTTP to 95.216.118.146:3000/3001. Behaviour and version-pin signature strongly suggest a single operator running a coordinated Solana-adjacent SDK-impersonation campaign
  • *Cluster C - `streak- Windows PE binary drop + WSL escalation** (4 packages, all 1.0.0): streak-core-lib, streak-core-math, streak-daily-lib, lib-streak-math. Each masquerades as day-math primitives; on import extracts a Windows PE binary (e.g. vite-native-helper.exe) into the user's %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup folder, achieving persistence at every logon. streak-daily-lib additionally performs WSL-to-Windows privilege escalation via powershell.exe` invocation from inside the Linux subsystem
  • *Cluster D - `aone- all-versions embedded malware** (3 packages, every version >= 0): aone-kit, aone-kit-cli, aone-sandbox. Same-scope coordinated publish with the boilerplate CWE-506 disclosure and no functional legitimate code - treat as pure attacker-owned scope, likely dep-confusion probes against Alibaba's internal aone` build system
  • Cluster E - xerohub-discord-voice-v2/v3 Discord-token stealer pair (v2 at 1.8.0, v3 at 3.0.0/3.0.2/3.0.3): startVoiceJoiner(config) POSTs the caller-supplied Discord token, secondary token, voice-server ID, and channel ID via axios to a hardcoded discord.com/api/webhooks/... URL controlled by the attacker; errors are silently swallowed to hide the theft
  • Cluster F - generic-name C2 domain communicator kit (7 packages, all 1.0.0/1.0.1/1.0.2): num-format-helper, string-format-kit, date-sanitize-helper, json-to-table-util, array-sort-helper, color-convert-helper, simple-probe-utils. All flagged with near-identical OpenSSF Package Analysis triggers ("communicates with domains associated with malicious activity and executes commands linked to harmful behavior") - likely one operator publishing under generic utility-library names to harvest AWS IAM credentials + cloud metadata
  • *Cluster G - `@joyfill/ prerelease-tag pair** (2 packages, unusual prerelease version strings 0.1.2-2773.beta.0 and 4.0.0-rc24-2773-beta.4): @joyfill/layouts, @joyfill/components. Coordinated same-scope publish under prerelease tags - same signature indicates dep-confusion / test-tag hijack against Joyfill's legitimate @joyfill/*` npm packages
  • Cluster H - misc high-signal single-package RATs: sigchain-js@1.0.1 (bundled payload decrypts + runs code from companion packages during install), text-line-parser@1.0.0 (env-var + cloud-cred exfil), triage_bot_using_sdkv3@2.0.1 (preinstall recon + file exfil), rollup-runtime-core-polyfills@0.0.1 (base64-decoded loader for svgcraft-core attacker module), tidal-embed-player@1.0.1, json-schema-inspector@1.1.4-1.1.7 (AES-256 remote payload decrypt), parallely@10.0.3 (concurrently typosquat, platform-specific dropper), jobber-app-template-react@1.0.1 (recon + file exfil disguised as React template), basic-vite@1.0.0 (system-data exfil preinstall), array-node-utils@1.0.9 / node-array-plus@1.0.9 (fetch-decrypt-execute remote payload pair - likely same operator, paired name signature), react-puller@1.0.0 (Windows binary + registry persistence), ethers-secure@1.0.0 (ethers.js typosquat, private-key exfil on wallet-function call), bianira-ui@1.27.0 (blockchain-based C2 resolution with encrypted dynamic payload), kordyn@0.9.16/0.9.18 (Windows PE64 to Startup on WSL import), korvica@1.0.0 (Windows binary fetch on WSL Linux import), @apexfnd/apex@1.0.0/1.0.1 (root-priv remote-code postinstall on macOS), @yancyyu/agentcli@1.9.32 (Lark/Feishu keychain-credential exfil), @ai_/autoprefixers@1.2.0 (autoprefixer typosquat, encrypted-C2 shell exec), @crbrc/xbt@1.1.0-1.1.4/1.2.1 (OxaPay-payment-credential exfil + TCP backdoor relay), fluid-type-ui@2.0.8 (Ethereum-blockchain C2 with encrypted payload)
  • Cluster I - all-versions generic-name credential stealers (5 packages, every version >= 0): postcss-motion-utils, local-config-parser, lib-mtop, cloud-config-fetcher, smart-config-manager. Every version replaced with 0.0.1-security sentinel; treat any lockfile pin as pre-yank confirmed compromise
  • 2026-07-29 OpenSSF Package Analysis batch (6 packages): chain-manager (all versions), chain-analyze (all versions - 2nd advisory follow-up on the 07-28 1.0.2 disclosure), @bowozzz/baileys (all versions), blots@2.1.0, @mypwn/hawkeye@99.0.0 (dep-confusion-style inflated major), toll_free@1.0.1
  • None of the 60 packages retain original tarballs on the public npm registry - all replaced with 0.0.1-security sentinels. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
  2. 2Highest priority - Cluster B (2.1.6 SSH-key harvester): any hit on app-svm-layer, app-sima-layer, app-sim-layer, app-soda-layer, api-node-sdk, or api-rust-sdk at 2.1.6 requires: (1) remove any unrecognised entries from ~/.ssh/authorized_keys on Linux/macOS build hosts, (2) audit host firewall for newly-opened inbound SSH rules, (3) block outbound to 95.216.118.146 and audit HTTP proxy logs for that IP across the exposure window, (4) rotate every Solana keypair, id.json, config.toml, and .env* value reachable from the build host
  3. 3*Cluster A (`@wagni_bot/ Telegram stealer)**: any hit on @wagni_bot/web3, @wagni_bot/wagni, @wagni_bot/polygon, @wagni_bot/opensea, @wagni_bot/hyperliquid, @wagni_bot/polymarket, @wagni_bot/metamask, @wagni_bot/eth, or @wagni_bot/bsc at 1.0.0: treat as full crypto-wallet-compromise event. Move funds via a clean device BEFORE attempting rotation. Rotate every SSH key, .env`-stored secret, and browser-wallet extension seed accessible from the dev host
  4. 4*Cluster C (`streak- Windows-PE dropper)**: any hit on streak-core-lib, streak-core-math, streak-daily-lib, or lib-streak-math at 1.0.0 on a Windows host or a WSL environment: check %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup for unrecognised .exe files (specifically vite-native-helper.exe / edge-native-helper.exe`-style names). Wipe and re-image the host - startup-folder persistence combined with the WSL cross-boundary payload means the malicious binary re-launches every logon
  5. 5Cluster E (xerohub-discord-voice-v2/v3 token stealer): any hit at the listed versions: rotate the exposed Discord bot token (Developer Portal → Bot → Regenerate), reset user account passwords that ever ran the compromised code, and audit the target Discord server's webhook list for attacker-owned URLs
  6. 6*Cluster G (`@joyfill/ prerelease-tag pair)**: verify no lockfile pins the two malicious prerelease tags (0.1.2-2773.beta.0 on @joyfill/layouts, 4.0.0-rc24-2773-beta.4 on @joyfill/components). Prerelease-tag hijacks slip past standard version-range resolvers when npm install --prefer-online runs - pin to explicit stable versions and set .npmrc save-prefix=""` in ephemeral CI images
  7. 7Cluster D + Cluster I (all-versions generic-name malware): for aone-kit, aone-kit-cli, aone-sandbox, postcss-motion-utils, local-config-parser, lib-mtop, cloud-config-fetcher, smart-config-manager - any lockfile match at any version is a compromise. If these names look like internal-scope hits (e.g. Alibaba aone build tooling), configure .npmrc scope→registry mapping to keep private-name resolution off the public registry
  8. 8For projects using postinstall-scripting packages, run npm install --ignore-scripts in CI as defense-in-depth and invoke scripts only for vetted first-party packages
  9. 9Verify none of the 60 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

References

Back to feedSubmit a correction
npm-2026-07-29-ghsa-malware-sweep