GitHub Advisory npm CWE-506 sweep - 50+ package 2026-08-06 batch (Sui-blockchain `sui-migration-audit-*` + `move-bcs-codec` cluster, `@activepieces/piece-*` typosquat sweep, `@ccfly/setup-*` platform-binary quartet, `@addai/*` cluster, `claude-remote-agent` RAT, `diezyyasha-baileys` + `alipclutch-baileys` WhatsApp cluster, `@holocronlab/botruntime-runtime` bot-framework masquerade, `helmet-pro` + `agenttunnels` + `agenthub-multiagent-mcp` + `typst-resume-cli` misc)

What happened

On 2026-08-06, the GitHub Advisory Database published 50+ new npm CWE-506 (Embedded Malicious Code) advisories in one of the largest single-day npm sweeps in recent history. The batch decomposes into eight clusters of varying sophistication, with the Sui blockchain tooling cluster and the @activepieces/piece-* sweep being the most operationally-notable.

Cluster A - Sui blockchain tooling / Move-BCS cluster (4 packages, 2026-08-06)

| Package | Notes | |---|---| | sui-migration-audit-cli | Sui migration audit CLI masquerade | | sui-migration-audit-rules | Rule-pack for the audit CLI (sibling) | | sui-graphql-client | Sui GraphQL client masquerade | | move-bcs-codec | Move / BCS (Binary Canonical Serialization) codec masquerade |

All four use the standard CWE-506 boilerplate ("any computer that has this package installed or running should be considered fully compromised - rotate all secrets from a different computer"). No behaviour-specific prose - but the name shapes are precise Sui-ecosystem developer targets:

• Sui migrations are the on-chain module-upgrade format; a migration-audit-cli would be exactly the kind of tool a Sui developer team installs during a protocol upgrade audit.
• sui-graphql-client matches the shape of the real Sui GraphQL indexer client - a developer building analytics on top of Sui's indexer would search for this name.
• move-bcs-codec matches the naming of BCS codec libraries used for on-chain Move serialization.

Combined with the same-week PyPI alphalend-layouts + alphalend-abi Sui keystore-stealer drop (see pypi-2026-08-07-ghsa-malware-sweep), the Sui developer ecosystem is under coordinated cross-language attack. Same operator running the pattern across npm + PyPI is plausible.

Cluster B - @activepieces/piece-* typosquat / takeover sweep (4 packages, 2026-08-06)

| Package | Notes | |---|---| | @activepieces/piece-google-contacts | Google Contacts Zapier-alternative piece | | @activepieces/piece-google-bigquery | Google BigQuery piece | | @activepieces/piece-google-forms | Google Forms piece | | @activepieces/piece-base44 | Base44 piece |

Activepieces is a real open-source no-code / low-code Zapier alternative with a rich plugin architecture where each integration is published as @activepieces/piece-*. These names match legitimate Activepieces piece names one-to-one - so the drops are either maintainer-account takeovers (worst case) or a maintainer briefly publishing malicious builds (Shai-Hulud-style). Any Activepieces self-hoster who ran pip install or the equivalent auto-piece-install pipeline in the 2026-08-06 window may have pulled a malicious version.

Worth checking the specific version pinned in the legitimate Activepieces release channel against your installed version. If your Activepieces install auto-updates pieces from npm, treat the whole install as suspect until the specific version installed for each of the four names is confirmed to match the upstream-known-good version.

Cluster C - @ccfly/setup-* platform-binary quartet (4 packages, 2026-08-06)

| Package | Platform | |---|---| | @ccfly/setup-darwin-arm64 | Apple Silicon | | @ccfly/setup-darwin-x64 | Intel Mac | | @ccfly/setup-linux-arm64 | Linux ARM64 | | @ccfly/setup-linux-x64 | Linux AMD64 |

Naming mimics the platform-binary distribution pattern used by legitimate packages like @esbuild/darwin-arm64, @rollup/linux-x64-gnu, @swc/core-darwin-arm64. A legitimate package will typically publish a small stub with optionalDependencies on the four platform variants, and npm will pull the one matching the installer's OS/arch. The operator squatted the pattern across all four platforms to guarantee the malicious binary fires regardless of the installer's environment.

The missing Windows platform (@ccfly/setup-win32-x64 / @ccfly/setup-win32-arm64) is notable - suggests the operator is targeting Unix-only build hosts (CI runners, Linux/Mac developer laptops) rather than Windows developers.

Cluster D - claude-remote-agent full-remote Claude agent RAT (1 package, 2026-08-06)

| Package | Notes | |---|---| | claude-remote-agent | Sibling to remote-claude-daemon (2026-08-07 batch); Claude-Code-flavored full-remote agent |

Earlier iteration of the same threat class documented in detail under npm-2026-08-07-ghsa-malware-sweep Cluster A - drives Claude with permission prompts disabled from a remote C2, providing indirect but powerful arbitrary-action capability. Almost certainly the same operator; the 2026-08-07 remote-claude-daemon drop is a rebrand/re-publish under a new package name after the 2026-08-06 name was flagged.

Cluster E - WhatsApp baileys sibling clones (2 packages, 2026-08-06)

| Package | Notes | |---|---| | diezyyasha-baileys | Baileys clone; WhatsApp session abuse | | alipclutch-baileys | Baileys clone; WhatsApp session abuse |

Two of the five variants in the multi-day baileys-clone cluster (three more dropped 2026-08-07 as @prototypevip/baileys, diezyclutch-baileys, ynastore-baileys). All abuse authenticated WhatsApp Web sessions from the installer host to broadcast messages under the installer's WhatsApp identity.

Cluster F - @holocronlab/botruntime-runtime bot-framework masquerade (1 package, 2026-08-06)

| Package | Notes | |---|---| | @holocronlab/botruntime-runtime | Scoped bot-runtime masquerade; likely dep-confusion against internal holocronlab package |

Cluster G - @addai/* AI-tooling cluster (3 packages, 2026-08-06)

| Package | Notes | |---|---| | @addai/ainode | AI-node component under addai scope | | @addai/node | Generic node package under addai scope | | @addai/entity-runtime | Entity runtime under addai scope |

Multiple sibling packages published under one scope in the same batch strongly suggests an enterprise-scope dep-confusion probe against a target org with an internal @addai/* namespace.

Cluster H - long tail (2026-08-06)

Enterprise scopes and one-off drops with boilerplate-only prose:

• Tinkoff / dolyame / BNPL bank cluster (Russian Tinkoff Bank dep-confusion continuation - see 2026-08-05 batch for the main burst): tinkoff-codeceptjs-storyshots-alpha, tinkoff-boxy-desktop-two-panel-right-image, statist-statist-core, statist-browser-typed-client-sme.rko.tariffs.web, devplatform-vite-plugin-gle, devplatform-spa-plugin-error-boundary, devplatform-jscodeshift-utils, devplatform-data-table.
• *`bigops- internal scope**: bigops-tcrm-permissions, app-api-sdk`.
• Ad-hoc: helmet-pro, jagproject, agenttunnels, agenthub-multiagent-mcp, tailwindcss-hide-scrollbar, @xiaohhhh1/canvas-agent, typst-resume-cli, @vanexalabs-ai/vanexa-agent, @atom8n/inspector, @apicity/meta, @innocarpe/deepseek-build, @bananacool467/ui-tools, @astralcore/aura-wb, @trackunit/iris-app-sdk-vite, fetchrtds, @aubea/mars, beautiful-ui-monitoring, @leejungkiin/awkit, @0l00000l/auth, @love-moon/conductor-cli, 9remote, svelte-visual-map, streak-cache-map, tui-react-tooltip, vitest-preview-pro-all, tsihealth-client, npm-dc-dev, ezdiscordbots, @chnayser/server.

All standard CWE-506 fully-compromised remediation.

Registry state

All packages yanked / security-replaced from npm during the 2026-08-06 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions.

Related tracked activity

• Sui cluster pairs with the PyPI alphalend-* keystore-stealer (see pypi-2026-08-07-ghsa-malware-sweep) - coordinated Sui-ecosystem attack across both languages.
• claude-remote-agent = sibling / earlier version of remote-claude-daemon (see npm-2026-08-07-ghsa-malware-sweep Cluster A).
• Baileys cluster began 2026-08-06 with these two variants; 3 more followed 2026-08-07.
• Tinkoff Bank dep-confusion continuation started with the massive 2026-08-05 batch (see npm-2026-08-05-ghsa-malware-sweep).
• No threatActor field set - GHSA advisories carry OpenSSF MAL-2026-* identifiers only.

Affected packages (58)

Impact

• Cluster A - Sui blockchain tooling / Move-BCS cluster (4 packages, 2026-08-06): sui-migration-audit-cli, sui-migration-audit-rules, sui-graphql-client, move-bcs-codec - all standard CWE-506 boilerplate, but the name shapes target Sui blockchain developers building on Move + BCS (Binary Canonical Serialization). Paired with the same-week PyPI alphalend-* Sui keystore-stealer (see pypi-2026-08-07-ghsa-malware-sweep), the Sui developer ecosystem is under coordinated cross-language attack this week
• *Cluster B - `@activepieces/piece- typosquat sweep** (4 packages, 2026-08-06): @activepieces/piece-google-contacts, @activepieces/piece-google-bigquery, @activepieces/piece-google-forms, @activepieces/piece-base44. Activepieces is a real open-source Zapier alternative with a rich pieces` plugin architecture - the operator squatted plausible Google-integration piece names for lookalike-install exploitation. Any Activepieces self-hoster who installed a "google" or "base44" piece may have hit the malicious variants
• *Cluster C - `@ccfly/setup- platform-binary quartet** (4 packages, 2026-08-06): @ccfly/setup-darwin-arm64, @ccfly/setup-darwin-x64, @ccfly/setup-linux-arm64, @ccfly/setup-linux-x64. Naming mimics the platform-specific binary distribution pattern used by legitimate packages (e.g. @esbuild/darwin-arm64, @rollup/linux-x64-gnu) - the operator squatted the pattern to lookalike-install alongside a target ccfly` package. Complete four-platform coverage ensures the malware fires regardless of the installer's OS/arch
• Cluster D - claude-remote-agent full-remote Claude agent RAT (1 package, 2026-08-06): sibling to remote-claude-daemon (2026-08-07 batch, see npm-2026-08-07-ghsa-malware-sweep Cluster A). Same threat class: driving Claude Code with permissions disabled from a remote C2. Only one version, but very likely the operator's earlier iteration before rebranding
• Cluster E - WhatsApp baileys sibling clones (2 packages, 2026-08-06): diezyyasha-baileys and alipclutch-baileys - two of the five variants in the multi-day baileys-clone cluster (three more dropped 2026-08-07 as @prototypevip/baileys, diezyclutch-baileys, ynastore-baileys). All abuse authenticated WhatsApp Web sessions
• Cluster F - @holocronlab/botruntime-runtime bot-framework masquerade (1 package, 2026-08-06): scoped-package bot-runtime tooling shape, likely dep-confusion against an internal Holocronlab bot-runtime package
• *Cluster G - `@addai/ AI-tooling cluster** (3 packages, 2026-08-06): @addai/ainode, @addai/node, @addai/entity-runtime`. Multiple sibling packages under one scope typical of enterprise-scope dep-confusion
• Cluster H - long tail (2026-08-06): helmet-pro, jagproject, agenttunnels, agenthub-multiagent-mcp, tailwindcss-hide-scrollbar, @xiaohhhh1/canvas-agent, typst-resume-cli, @vanexalabs-ai/vanexa-agent, @atom8n/inspector, @apicity/meta, @innocarpe/deepseek-build, @bananacool467/ui-tools, @astralcore/aura-wb, @trackunit/iris-app-sdk-vite, fetchrtds, @aubea/mars, beautiful-ui-monitoring, @leejungkiin/awkit, @0l00000l/auth, @love-moon/conductor-cli, 9remote, svelte-visual-map, streak-cache-map, devplatform-vite-plugin-gle, tinkoff-codeceptjs-storyshots-alpha, devplatform-spa-plugin-error-boundary, tui-react-tooltip, devplatform-jscodeshift-utils, statist-statist-core, tinkoff-boxy-desktop-two-panel-right-image, devplatform-data-table, vitest-preview-pro-all, tsihealth-client, npm-dc-dev, ezdiscordbots, statist-browser-typed-client-sme.rko.tariffs.web, app-api-sdk, bigops-tcrm-permissions, @chnayser/server. Standard CWE-506 fully-compromised remediation applies
• All packages yanked / security-replaced from npm during the 2026-08-06 takedown. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs BEFORE the takedown WILL keep serving the original versions

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the full 2026-08-06 package list below. Any match is a supply-chain incident: rotate every credential the build runner could reach and re-image the build host
2. 2For Sui developers: audit any sui-* or move-* npm dependency in the last 30 days. Any match on the Sui-cluster packages above should be treated together with alphalend-* PyPI matches (see pypi-2026-08-07-ghsa-malware-sweep) as one coordinated Sui ecosystem attack - move Sui assets off compromised addresses to fresh wallets on an isolated host
3. 3For Activepieces self-hosters: verify installed pieces against the official activepieces/activepieces repo packages/pieces/ directory - the legitimate Google-integration pieces are @activepieces/piece-google-contacts (real), etc., so the malicious variants use the exact same scope + package names as legitimate pieces, meaning the compromise is a maintainer/publish takeover or account compromise rather than a plain typosquat. Check the specific published version installed matches the version pinned by the legitimate Activepieces release
4. 4For claude-remote-agent matches (critical): same remediation as remote-claude-daemon - the host was likely fully-remoted by the operator with Claude permissions disabled. Audit git history + shell history + cloud API calls for the last 30 days and re-image
5. 5For baileys-clone matches: revoke WhatsApp Web sessions from WhatsApp Settings → Linked Devices → Log Out From All Devices
6. 6For @ccfly/setup-* matches: platform-binary distribution packages usually resolve based on optionalDependencies + platform detection - verify which real package your build was trying to install a platform binary for; if ccfly is not a real dependency of your project, the resolution was a dep-confusion hit
7. 7For all npm installs in CI, run with --ignore-scripts as defense-in-depth to prevent preinstall/postinstall payloads from executing
8. 8Verify none of the 2026-08-06 packages still resolves via your private mirror

References

• GHSA-h2cr-h9m7-mxg3 - sui-migration-audit-cli malware advisory

  github.com
  GitHub
• GHSA-3xg5-x743-4fjc - sui-graphql-client malware advisory

  github.com
  GitHub
• GHSA-f9p8-c2qh-w7cm - sui-migration-audit-rules malware advisory

  github.com
  GitHub
• GHSA-3v7v-gr39-jf7v - move-bcs-codec malware advisory

  github.com
  GitHub
• GHSA-f4vp-4vr3-ff5j - @activepieces/piece-google-contacts malware advisory

  github.com
  GitHub
• GHSA-9vjf-gwwg-57fp - @activepieces/piece-google-bigquery malware advisory

  github.com
  GitHub
• GHSA-vmfr-7cqr-9wc8 - claude-remote-agent malware advisory

  github.com
  GitHub
• GHSA-78fc-2672-hcjg - diezyyasha-baileys malware advisory

  github.com
  GitHub
• GHSA-jw7v-xrmm-426j - alipclutch-baileys malware advisory

  github.com
  GitHub
• GHSA-xj5f-xpqg-6pv6 - @ccfly/setup-darwin-arm64 malware advisory

  github.com
  GitHub
• GHSA-c8p8-hx32-6q2r - npm-dc-dev malware advisory (obfuscated postinstall)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub