GitHub Advisory npm CWE-506 sweep - 8-package 2026-08-02 batch (`houzidawang806/807/808` sequential-namespace trio, `simple-date-formatter-util`/`-1`/`-2` date-util trio, `tailwindcss-anim` Tailwind-ecosystem typosquat, `list-issue-predecessor-dependencies-block@99.0.0` OpenSSF-PA C2-domain communicator with dep-confusion inflated pin)

What happened

On 2026-08-02, the GitHub Advisory Database published 8 new npm CWE-506 (Embedded Malicious Code) advisories in a same-day burst. This module catalogues that batch. Modest-sized batch relative to the massive 2026-07-31 wave (91 packages) - the 08-02 batch reads as tail-end operator activity with two coordinated 3-package name-template bursts plus one Tailwind-ecosystem typosquat and one OpenSSF-PA-flagged C2-domain communicator with dep-confusion pinning.

Cluster A - houzidawang806/807/808 sequential-namespace trio (3 packages, 2026-08-02)

| Package | Notes | |---|---| | houzidawang806 | houzidawang<NNN> numbered-namespace template | | houzidawang807 | houzidawang<NNN> numbered-namespace template | | houzidawang808 | houzidawang<NNN> numbered-namespace template |

Same-day publish of 3 packages under a shared houzidawang<NNN> naming template. Every advisory in the cluster carries the standard CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised") with no additional per-package behaviour prose. The houzi dawang root reads as a CJK transliteration ("monkey king", 猴子大王, or a similar handle) and the numeric suffix increments sequentially (806, 807, 808) - consistent with an operator running a namespace-enumeration burst using a fixed handle plus a counter.

The naming pattern reads strongly as researcher / red-team upload activity - no ordinary developer types npm install houzidawang807 - but GHSA classified all 3 as CWE-506 embedded malicious code, meaning static analysis or Package Analysis (OpenSSF) tripped on real malicious behaviour in the tarballs regardless of the researcher-vs-criminal origin. A lockfile hit is still an incident: either genuine malware or an unauthorised researcher upload that still exfiltrates on install.

Cluster B - simple-date-formatter-util + -1 + -2 date-utility trio (3 packages, 2026-08-02)

| Package | Notes | |---|---| | simple-date-formatter-util | canonical simple-*-formatter-util typosquat lane | | simple-date-formatter-util-1 | numbered variant (-1 sibling) | | simple-date-formatter-util-2 | numbered variant (-2 sibling) |

Same-day publish of 3 packages under a shared simple-date-formatter-util[-N] naming template. All three share the CWE-506 boilerplate ("fully compromised, rotate secrets"). The -1/-2 sibling variants are a common operator pattern for hedging against a takedown: if npm security removes simple-date-formatter-util, the -1 and -2 copies remain resolvable until the takedown enumerates the numbered siblings. Same pattern observed in the earlier test-dev-* bursts and the date-sanitize-helper / string-format-kit clusters.

The simple-date-formatter-util name plausibly typosquats one of the ~40 legitimate simple-*-formatter / date-format-* / date-fns-* utility packages that ship a SimpleDateFormatter API surface (a well-known Java API name that many JS ports mirror). Developers searching for a "simple date formatter util" via npm search or dev-tooling autocomplete would plausibly land on one of these names.

Cluster C - tailwindcss-anim Tailwind-ecosystem typosquat (1 package, 2026-08-02)

| Package | Notes | |---|---| | tailwindcss-anim | typosquat against tailwindcss-animate (~1.7M weekly downloads) |

GHSA-m326-xg22-g2fx carries the standard CWE-506 boilerplate. The tailwindcss-anim name shape is a classic abbreviated-suffix typosquat against the highly-popular legitimate tailwindcss-animate plugin - the -anim suffix reads as the natural developer-shorthand for animate / animation and would resolve preferentially for anyone typing from memory rather than copy-pasting from Tailwind's official docs.

The operator followed up with a same-lane counterpart tailwind-anim (dropping the css connector) published one day later on 2026-08-03 - see npm-2026-08-03-ghsa-malware-sweep Cluster A. The two variants together cover the two most common autocomplete-truncation misspellings of tailwindcss-animate.

Cluster D - list-issue-predecessor-dependencies-block@99.0.0 OpenSSF-PA C2-domain communicator with dep-confusion pin (1 package, 2026-08-02)

| Package | Version | Notes | |---|---|---| | list-issue-predecessor-dependencies-block | 99.0.0 | OpenSSF PA: malicious-domain communication + malicious-command execution, dep-confusion inflated pin |

GHSA-fjgr-3cq9-qxm6 records OpenSSF Package Analysis flagged the tarball for both "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior." Two distinct dynamic-analysis signals - active outbound C2 traffic AND command execution observed at analysis time - indicating this is not a static-metadata heuristic flag but confirmed runtime malicious behaviour.

The 99.0.0 version pin is the canonical dependency-confusion inflated pin - it guarantees the resolver picks the public malicious version over any internal list-issue-predecessor-dependencies-block library at any real semver like 1.2.3 or 4.5.6. The verbose highly-specific package name (list-issue-predecessor-dependencies-block) reads as an internal-tooling naming shape - plausibly a Jira / GitHub Issue integration tool that lists issues blocking or being blocked by a target issue via a predecessor-dependencies query (Jira Portfolio, Structure, BigPicture, and similar issue-dependency-graph tools all expose this concept). An org that maintains such tooling as an internal npm package would resolve the public malicious version preferentially on any CI job that misconfigures its .npmrc scope or --registry precedence.

Registry state

All 8 packages security-replaced during the 2026-08-02 batch. Original version tarballs are no longer resolvable on the public registry, but private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• Cluster A houzidawang* sequential-namespace burst matches the pattern of the test-dev-* 8-package burst catalogued in npm-2026-08-01-ghsa-malware-sweep Cluster A. Same operator profile (test-shape names published in bursts, GHSA-flagged CWE-506, no per-package behaviour prose).
• Cluster B simple-date-formatter-util[-N] numbered-variant lane matches the same take-down-hedging pattern used in earlier date-sanitize-helper / string-format-kit clusters catalogued across the 2026-07-2x sweeps.
• Cluster C tailwindcss-anim explicitly pairs with the 2026-08-03 tailwind-anim variant (see npm-2026-08-03-ghsa-malware-sweep Cluster A) - same operator, adjacent-day publishes on the two most likely autocomplete-truncation misspellings of tailwindcss-animate.
• Cluster D list-issue-predecessor-dependencies-block@99.0.0 is the same C2-domain + command-execution OpenSSF-PA signature seen in pp-react-worldready@1.0.0 (2026-08-01), num-format-helper / string-format-kit / date-sanitize-helper (2026-07-29), and the earlier phabricator-client@99.x PyPI advisories - recurring OpenSSF-PA-flagged single-package drops with dep-confusion inflated version pins.
• No threatActor field is set - GHSA advisories in this batch use only the CWE-506 boilerplate with no named actor attribution.

Affected packages (8)

Impact

• Any host that installed any of the 8 npm packages listed below should be treated as fully compromised - every GHSA advisory in this batch uses the CWE-506 boilerplate: "any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer" - and no patched version exists
• Cluster A - houzidawang806/807/808 sequential-namespace trio (3 packages, all >= 0, all 2026-08-02): houzidawang806, houzidawang807, houzidawang808. Same-day publish of 3 packages under a shared houzidawang<NNN> numbered-namespace template - one operator running a namespace-enumeration burst using a fixed CJK-transliterated username (houzi dawang roughly transliterates from Mandarin as "monkey king") plus a numeric suffix. The naming pattern reads as researcher / red-team test uploads (no developer would npm install houzidawang806), but GHSA classifies all 3 as CWE-506 embedded malicious code so treat lockfile hits as real incidents
• Cluster B - simple-date-formatter-util + -1 + -2 date-utility trio (3 packages, all >= 0, all 2026-08-02): simple-date-formatter-util, simple-date-formatter-util-1, simple-date-formatter-util-2. Same-day publish of 3 packages under a shared simple-date-formatter-util[-N] naming template - plausibly a typosquat probe against the ~40 legitimate simple-*-formatter / date-format-* utility packages that ship a SimpleDateFormatter API surface for React and Node dev tooling. Consumers running dev-tools autocomplete or npm search for a "simple date formatter util" would plausibly land on one of these names
• Cluster C - tailwindcss-anim Tailwind-ecosystem typosquat (1 package, >= 0, 2026-08-02): tailwindcss-anim. Name-shape typosquat against the legitimate tailwindcss-animate (~1.7M weekly downloads) and tailwindcss-animated - the abbreviated -anim suffix relies on autocomplete truncation or memory-slip from developers who remember the animation package as "the Tailwind anim plugin". Same-operator counterpart to the tailwind-anim variant published one day later under the 2026-08-03 batch (see npm-2026-08-03-ghsa-malware-sweep)
• Cluster D - list-issue-predecessor-dependencies-block@99.0.0 OpenSSF-PA C2-domain communicator with dep-confusion inflated pin (1 package, = 99.0.0, 2026-08-02): list-issue-predecessor-dependencies-block. GHSA-fjgr-3cq9-qxm6 records OpenSSF PA flagged the tarball for BOTH "communicates with a domain associated with malicious activity" AND "executes one or more commands associated with malicious behavior" - active outbound C2 traffic plus command execution observed at analysis time (not merely static-metadata heuristics). The extreme-inflated 99.0.0 version pin is the canonical dep-confusion technique targeting an internal list-issue-predecessor-dependencies-block package plausibly used inside a Jira / GitHub Issue integration tool at an org that maintains issue-dependency-graph tooling as an internal npm package
• None of the 8 packages retain original tarballs on the public npm registry - all replaced with security sentinels during takedown. Private registry mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for each name in the packages map below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. 2*Cluster A (`houzidawang)**: any lockfile hit on any of the 3 houzidawang<NNN>` packages is either a researcher/red-team unauthorised upload landing on your CI or an actual malicious drop - both require the same response. Delete the resolved package, purge from any private-registry cache, and rotate the credentials that the build had access to. If pulled by a downstream transitive dependency, escalate to a broader dep-graph audit - that transitive path is the real vulnerability
3. 3*Cluster B (`simple-date-formatter-util)**: any lockfile hit is a supply-chain incident - the operator is riding the simple--formatter-util typosquat lane against the ~40 legitimate simple-date-/date-format-*` utility packages. Confirm the intended package name against the actual dependency the developer meant to add, delete the malicious resolution, and rotate every credential the build runner could reach
4. 4Cluster C (tailwindcss-anim): any lockfile hit is a Tailwind-ecosystem typosquat incident - the operator is targeting the ~1.7M-weekly-download tailwindcss-animate legitimate package. Confirm the intended package (typically tailwindcss-animate or tailwindcss-animated), delete the malicious tailwindcss-anim resolution, and rotate every credential the build could reach. The counterpart tailwind-anim variant (see npm-2026-08-03-ghsa-malware-sweep) uses the same typosquat lane and warrants the same response
5. 5Cluster D (list-issue-predecessor-dependencies-block@99.0.0): any lockfile hit is a supply-chain incident - OpenSSF PA specifically flagged live outbound traffic to a known-malicious domain AND malicious command execution, indicating the payload phones out AND executes commands during install or import. Orgs that maintain a list-issue-predecessor-dependencies-block internal npm package (Jira / GitHub Issue integration tooling): configure .npmrc scope-to-registry mapping or overrides to block the public-registry version from resolving, and audit outbound DNS from any host that resolved this package in the last 72h
6. 6For every npm install in CI, run with --ignore-scripts as defense-in-depth to prevent postinstall-triggered payloads from executing during dependency installation
7. 7Verify none of the 8 listed packages still resolves via your private mirror - internal Artifactory / Nexus / Verdaccio instances routinely cache tarballs and will keep serving the original versions after the public yank

References

• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• GHSA-7gf8-h22p-4qr4 - houzidawang806 malware advisory

  github.com
  GitHub
• GHSA-f2g2-48mf-957v - houzidawang807 malware advisory

  github.com
  GitHub
• GHSA-4qvg-392x-j32q - houzidawang808 malware advisory

  github.com
  GitHub
• GHSA-q32h-xc3m-rc77 - simple-date-formatter-util malware advisory

  github.com
  GitHub
• GHSA-mmc7-8pmj-h3xj - simple-date-formatter-util-1 malware advisory

  github.com
  GitHub
• GHSA-q43f-5xj6-8v63 - simple-date-formatter-util-2 malware advisory

  github.com
  GitHub
• GHSA-m326-xg22-g2fx - tailwindcss-anim malware advisory (Tailwind CSS ecosystem typosquat)

  github.com
  GitHub
• GHSA-fjgr-3cq9-qxm6 - list-issue-predecessor-dependencies-block malware advisory (OpenSSF PA C2 + command exec, dep-confusion inflated pin)

  github.com
  GitHub