DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
CriticalPublished 11 Aug 202638 packages · 117 versions

GitHub Advisory npm CWE-506 sweep - 2026-08-11 batch (webhook.site Web3 typosquat credential-theft ring `@openzeppelin-4/5/contracts`+`@aerodrome-finance/contracts`+`@aerodrome-finance/slipstream`+`ethereum-vault-connector`, `safe-local-env-loader` env-local RAT sibling, `newtun` unencrypted-WebSocket PTY RAT with self-update, `svelte-vim-kit`+`kit-vim-map` map-streak-kit family continuation, `@nzeros/codebreak` Go ELF disguised as C solver, `base65-*` base-x typosquat cluster with 123KB obfuscated payload + `bs58-*` boilerplate siblings, coordinated `oastify.com`/`sslip.io`/webhook OAST dep-confusion recon beacons)

Summary

38 npm CWE-506 advisories published 2026-08-11. Headline: five-package Web3 typosquat ring (@openzeppelin-4/contracts, @openzeppelin-5/contracts, @aerodrome-finance/contracts, @aerodrome-finance/slipstream, ethereum-vault-connector) sharing the same webhook.site credential-exfil TTP with 60-240s detached-process delay + sandbox evasion, safe-local-env-loader continuing the 2026-08-10 env-local Windows RAT, and newtun shipping a PTY reverse shell with self-update.

typosquatcredential-theftcrypto-wallet-draindependency-confusionobfuscationinfostealer
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · npm Security · amazon-inspector
Also known as
2026-08-11 GHSA npm batch · Web3 SDK typosquat webhook.site ring · env-local RAT day-2 · map-streak-kit family day-3 · newtun 7ii.win WebSocket RAT
Ecosystems
npm
Packages tracked
38

What happened

On 2026-08-11, the GitHub Advisory Database published 38 new npm CWE-506 (Embedded Malicious Code) advisories. The batch has an unusually well-differentiated shape: a five-package Web3 typosquat ring sharing a single credential-exfil TTP, a continuation of the 2026-08-10 env-local Windows RAT cross-porting to macOS, a self-updating WebSocket PTY RAT, further siblings of the map-streak-kit Linux implant family, a Go ELF disguised as a C solver, a nine-package base58 typosquat cluster, and a coordinated wave of internal-scope dep-confusion recon beacons hitting Discover / Samsung / other named target orgs.

Cluster A - Web3 typosquat credential-theft ring (5 packages, shared webhook.site TTP)

| Package | Versions | GHSA | Impersonated target | |---|---|---|---| | @openzeppelin-5/contracts | 1.0.0, 1.0.1 | GHSA-3px4-879m-x8q7 | @openzeppelin/contracts (v5) | | @openzeppelin-4/contracts | 1.0.0, 1.0.1 | GHSA-g472-m8m8-w6h3 | @openzeppelin/contracts (v4) | | @aerodrome-finance/contracts | 1.0.0, 1.1.0, 1.1.1 | GHSA-wj9v-gmm3-32pv | Aerodrome Finance Solidity contracts | | @aerodrome-finance/slipstream | 1.0.0, 1.1.0, 1.1.1 | GHSA-p457-j9cc-cpmp | Aerodrome Slipstream (Uniswap v3-style AMM) | | ethereum-vault-connector | 1.0.0, 1.1.0, 1.1.1 | GHSA-4c5m-f9mr-jxrp | Euler Labs Ethereum Vault Connector |

Shared TTP (code fingerprint matches across all five):

  1. Postinstall / preinstall hook filters process.env for KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/AWS/GITHUB/NPM/WALLET.
  2. Reads ~/.aws/, ~/.ssh/, ~/.kube/, ~/.docker/, ~/.netrc, ~/.npmrc, plus blockchain keystores under ~/.foundry/, ~/.config/solana/, Sui client config, and gcloud.
  3. Serialises the payload and spawns a detached Node child process (spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'})) with a randomised 60-240 second delay before POSTing to a hardcoded webhook.site endpoint. @openzeppelin-4/contracts uses webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09.
  4. Sandbox evasion: checks hostnames against scan- / detonation / honeypot markers, checks the resolved npm registry, and throws early on non-standard hosts to defeat automated malware sandboxes.

The shared code fingerprint plus a common webhook host register places this squarely inside a single operator running a coordinated DeFi / Solidity SDK typosquat wave. Naming targets three high-value DeFi ecosystems (OpenZeppelin, Aerodrome Finance, Euler Labs) with the same exfil primitive - budget your remediation on the assumption further sibling drops targeting other DeFi SDKs (Uniswap, Compound, Aave, Morpho, Yearn) will land in the next 24-72h from the same operator.

Cluster B - safe-local-env-loader env-local RAT sibling (1 package, cross-platform screen capture)

| Package | Versions | GHSA | Impersonated target | C2 | |---|---|---|---|---| | safe-local-env-loader | 1.0.0 | GHSA-4g37-2gh5-825v | dotenv | 192.99.204.157:5000 |

Masquerades as dotenv. Ships the identical stack to env-local from 2026-08-10 Cluster F: captures full desktop screenshots every 3 seconds on both Windows and macOS, transmits to the C2 with system metadata, polls the same C2 for mouse/keyboard commands and replays them locally via @nut-tree-fork/nut-js, and on Windows writes a VBS launcher + HKCU\...\Run registry entry for boot persistence. The activation stub is a require("./tui-options") line appended to the legitimate dotenv init so the agent fires when consumer code loads the module. Different C2 host than env-local (192.99.204.157:5000 vs env-local's hardcoded upload target) but the code and the persistence layout match - same operator, second-day drop with a slightly widened OS surface (macOS added).

Cluster C - newtun unencrypted-WebSocket PTY RAT with self-update (1 package, ws://pull.7ii.win:7999)

| Package | Versions | GHSA | C2 | |---|---|---|---| | newtun | 1.0.0-1.0.27 | GHSA-3xv7-433h-78x9 | ws://pull.7ii.win:7999 |

Opens an unencrypted WebSocket to pull.7ii.win:7999, spawns interactive PTY shells for remote command execution, reads/writes/deletes/renames arbitrary files (~/.ssh and ~/.aws explicitly named in the advisory as sensitive-path targets), transmits hostname + OS + arch + Node version + CPU/memory stats + network traffic every 5 seconds, and includes a self-update primitive that installs new global versions of itself without user approval - the operator rotates payload silently on any host still running the WebSocket. The pull.7ii.win egress is a durable IOC block target because the connection is unencrypted (deep-packet inspection can identify the WebSocket handshake without TLS interception).

Cluster D - svelte-vim-kit + kit-vim-map map-streak-kit family third-day continuation (2 packages)

| Package | Versions | GHSA | |---|---|---| | svelte-vim-kit | >=0 (1.0.0) | GHSA-rvh4-87p7-h5pm | | kit-vim-map | >=0 (1.0.0) | GHSA-mj69-vr76-h2mq |

Both carry only the boilerplate CWE-506 text on the GHSA advisory pages. The naming morphology (svelte-*-kit, kit-*-map) and the batch timing places them squarely inside the map-streak-kit implant family established in the 2026-08-08 batch (map-streak-kit, streak-map-kit, svelte-streak-kit, svelte-kit-cache) and continued in the 2026-08-10 batch (svelte-kit-streak, kit-map-streak). Third consecutive daily drop from this operator - the current register pattern is <framework>-<editor>-kit and kit-<editor>-map.

Cluster E - @nzeros/codebreak Go ELF disguised as C solver (1 package, Linux x64 auto-exec)

| Package | Versions | GHSA | |---|---|---| | @nzeros/codebreak | 1.3.0 | GHSA-jwj4-j62g-2xg8 |

Advertises itself as a C minimax solver. Ships three vendor binaries: vendor/solver-darwin-arm64 is a legitimate ~34KB Mach-O, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are byte-identical 33.6MB Linux Go ELF binaries linked against network clients, process-execution utilities, and cryptographic libraries - entirely inconsistent with a solver algorithm. A postinstall script auto-executes the Linux binary on Linux x64 systems during npm install. The Go binaries are opaque and cannot be verified to match the advertised C source.

Cluster F - Base58 typosquat cluster (base65-* runtime hook + bs58-* boilerplate siblings, 9 packages)

*`base65-` (obfuscated payload, runtime hooks)**

| Package | Versions | GHSA | |---|---|---| | base65-11x | <=5.0.2 | GHSA-7ww3-26rx-3cpf, GHSA-39c6-h85q-hpcw | | base65-12x | <=5.0.2 | GHSA-q6r6-qrfx-v3wp, GHSA-c4w7-m3hx-xx75 | | base65-13x | <=5.0.2 | GHSA-pm9q-qccp-rj4g, GHSA-fp83-xcpx-v3qm | | base65-15x | <=5.0.2 | GHSA-m962-7hqx-p4h8 | | base65-33x | <=5.0.2 | GHSA-q6wg-mgq7-rq2h | | base65-77x | <=5.0.2 | GHSA-72rx-9qc9-2c73 |

Each ships the legitimate base-x source followed by a ~123KB top-level obfuscated block that installs dispatchers on globalThis under registries vmr_3f4688 and vmw_bf472f, manipulates Object.defineProperty and __proto__ to intercept object operations, and calls fetch from inside the obfuscated block. Runs unconditionally on require/import in both CJS and ESM.

*`bs58-` (boilerplate CWE-506, likely siblings)**

| Package | Versions | GHSA | |---|---|---| | bs58-11 | >=0 | GHSA-mw39-7442-3p8m | | bs58-12 | >=0 | GHSA-x9c8-g63x-mh7q | | bs58-13 | >=0 | GHSA-72pr-qcvq-fgpg |

The naming shift (base65-Nx vs bs58-N) strongly implies sibling drops from the same operator staging both base58-encoding-library typosquat registers in parallel. The real target packages are base-x (multibase encoder) and bs58 (base58 for Bitcoin) - both are popular deps in the Solana / Bitcoin / Ethereum tooling ecosystems.

Cluster G - Coordinated dep-confusion / OAST recon beacon wave (8 packages, multiple destinations)

| Package | Version | GHSA | Beacon destination | Notable | |---|---|---|---|---| | @dgn-src-click-to-pay-org/srcdcfreleasecert | 999.0.1 | GHSA-hfmm-qxg4-g578 | Bare-IP HTTP endpoint | Impersonates Discover/SRC click-to-pay; PAN/Luhn cover code | | dcfarguscert | 999.0.1 | GHSA-mf24-fh58-62x2 | http://16-171-38-148.sslip.io:8080/api/install | npm ls -g global-package inventory exfil | | bjm-low-code-components | 99.0.0 | GHSA-r8w4-qgmq-q94q | 2pslbvbc3adfni1pbe9xy2b1asgj4cs1.oastify.com/bjm-canary | Burp Collaborator OAST | | chapters-core | 9.999.999 | GHSA-f5jm-mx92-p845 | awfhvaksncnsxtcdjvmnhhqbt59dzenf8.oast.fun | Leaves samsung-depconf-poc.json marker | | ghazaly | 99.9.0 | GHSA-2j9m-4gmh-3m8p | xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com | Shared OAST endpoint with dependencyfsdsfdsfg | | dependencyfsdsfdsfg | 99.9.0 | GHSA-5928-vc2p-hrqj | xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com | Shared OAST endpoint with ghazaly | | whs4_ued | 1.0.0 | GHSA-v5xx-cpfg-4c3j | Discord webhook 1530599209269465319 | Runtime string-concat token to evade static detection | | zeal-rq-hooks | 0.0.0 | GHSA-62m8-8rfw-gv5v | npm-canary.aveliscare.com | Amazon Inspector detection |

The concentration of Samsung / Discover / internal-scope dep-confusion probes on a single day suggests multiple red teams (or attackers) are actively enumerating internal scopes. The ghazaly + dependencyfsdsfdsfg shared endpoint means those two are demonstrably the same operator running two probes in parallel.

Cluster H - sui-gql-client + sui-bcs-codec Sui blockchain typosquat pair (2 packages)

| Package | Versions | GHSA | Typosquats | |---|---|---|---| | sui-gql-client | >=0 | GHSA-2ggf-86xw-xjp5 | @mysten/sui/graphql/client | | sui-bcs-codec | >=0 | GHSA-2wqc-3243-4hxm | @mysten/bcs |

Boilerplate CWE-506 on both advisory pages, but naming targets the official Sui blockchain @mysten/* scope. Treat as capable of the same wallet-key theft / credential-exfil behaviour as the Cluster A ring until Socket or OpenSSF post the malicious-package sample.

Cluster I - Boilerplate CWE-506 drops (9 packages, behaviour uncharacterised)

internallib_v164 (GHSA-3qvf-g7pq-m3m3), tsihealth-client (GHSA-jcwv-5jc7-grp5), tilaver-mfa (GHSA-4j5x-wjw6-qvq5), developer-dashboard (GHSA-vf74-54mr-mp44), fetch-runtime (GHSA-3hqj-592v-g33j), vite-svg-parse (GHSA-v7x8-w6xp-6mv4), node-internal-svg-loader (GHSA-9rgf-6m2p-q73f), lines-columns (GHSA-572q-x4v9-m474), dakumangalsingh_virus (GHSA-ppp3-vpgx-2v73). All ship the standard "any computer that has this package installed or running should be considered fully compromised" text. Naming implies target categories: internallib_v164 and developer-dashboard are internal-scope dep-confusion lures; tilaver-mfa typosquats MFA tooling; vite-svg-parse and node-internal-svg-loader typosquat Vite / Node SVG loader plugins; fetch-runtime and lines-columns typosquat standard utilities.

Registry state

All 38 packages yanked or security-holding-replaced from npm during the 2026-08-11 takedown window. Private mirrors (Verdaccio, Artifactory, Nexus) that cached tarballs before takedown will keep serving the malicious versions.

Related tracked activity

  • env-local / safe-local-env-loader Windows/macOS screen-capture RAT register: Cluster B is the second-day drop of the 2026-08-10 env-local Cluster F Windows RAT. Same operator, macOS surface added.
  • map-streak-kit Linux implant family: Cluster D is the third consecutive daily drop of the family established on 2026-08-08 and continued on 2026-08-10.
  • Web3 SDK typosquat register: Cluster A is a coordinated wave against DeFi SDKs (OpenZeppelin, Aerodrome, Euler). Expect further sibling drops in the next 24-72h targeting Uniswap, Compound, Aave, Morpho, Yearn.
  • Discovery credits: OpenSSF malicious-packages, OpenSSF Package Analysis, npm Security, amazon-inspector. No named threat actor.

Affected packages (38)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Cluster A - Web3 typosquat credential-theft ring (5 packages, shared webhook.site TTP): @openzeppelin-4/contracts@1.0.0..1.0.1, @openzeppelin-5/contracts@1.0.0..1.0.1, @aerodrome-finance/contracts@1.0.0..1.1.1, @aerodrome-finance/slipstream@1.0.0..1.1.1, and ethereum-vault-connector@1.0.0..1.1.1 all execute the same postinstall payload: filter process.env for KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/AWS/GITHUB/NPM/WALLET; read ~/.aws/, ~/.ssh/, ~/.kube/, ~/.docker/, ~/.netrc, ~/.npmrc, blockchain keystores (Foundry, Solana, Sui, gcloud); spawn(process.execPath, ['-e', src], {detached:true, stdio:'ignore'}) with a randomised 60-240 second delay to outlive install-time scanning windows; POST the bundle to a hardcoded webhook.site endpoint (@openzeppelin-4/contracts uses webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09); sandbox-evasion checks for scan-/detonation/honeypot hostnames and non-standard registries. Same code fingerprint across all five packages - a single operator running a coordinated DeFi/Solidity SDK typosquat wave
  • Cluster B - safe-local-env-loader Windows/macOS screen-capture + remote-control implant (env-local Aug-10 sibling): safe-local-env-loader@1.0.0 masquerades as dotenv (same target as env-local from 2026-08-10 Cluster F) and ships the identical screen-capture-every-3-seconds + mouse/keyboard replay via @nut-tree-fork/nut-js + VBS + HKCU\...\Run persistence stack, but this drop uses a different C2 (192.99.204.157:5000 vs env-local's stack) and captures on both Windows and macOS rather than Windows-only. Appends require("./tui-options") to the legitimate dotenv init to activate the agent when the module loads. Any developer workstation that pulled it gets a live persistent remote-desktop RAT with cross-platform screen capture
  • Cluster C - newtun unencrypted-WebSocket PTY RAT with self-update (pull.7ii.win:7999): newtun@1.0.0..1.0.27 opens an unencrypted WebSocket to pull.7ii.win:7999, spawns interactive PTY shells for remote command execution, reads/writes/deletes/renames arbitrary files (~/.ssh, ~/.aws explicitly named), transmits hostname + OS + arch + Node version + CPU/memory/network stats every 5 seconds, and includes a self-update primitive that installs new global versions of itself without user approval - the operator can rotate payload silently on any host still running the WebSocket. Any host that installed newtun should be considered fully compromised at the OS + credential + persistence level, and the WebSocket egress point is a durable IOC block target
  • Cluster D - svelte-vim-kit + kit-vim-map map-streak-kit implant family continuation: svelte-vim-kit and kit-vim-map carry only boilerplate CWE-506 on their GHSA pages, but the naming morphology (svelte-*-kit, kit-*-map) puts them squarely in the 2026-08-08 map-streak-kit cluster and the 2026-08-10 svelte-kit-streak/kit-map-streak continuation. The 08-08 batch established a Linux binary implant with systemd persistence, C2 beacon to 217.60.77.63, and SSH-key + credential exfil - treat these two as sibling drops of the same implant family until Socket or OpenSSF post a differentiated sample. Third day in a row this operator has published the same-shape package pair
  • Cluster E - @nzeros/codebreak Go ELF disguised as C minimax solver (Linux x64 auto-exec): @nzeros/codebreak@1.3.0 ships three "vendor" binaries - vendor/solver-darwin-arm64 is a legitimate ~34KB Mach-O, but vendor/solver-darwin-x64 and vendor/solver-linux-x64 are byte-identical 33.6MB Linux Go ELF binaries linked against network + process-execution + crypto libraries entirely inconsistent with a solver algorithm. A postinstall script auto-executes the Linux binary on Linux x64 systems during npm install. The Go binaries are opaque and cannot be verified to match the advertised C source. Any Linux x64 workstation or CI runner that pulled the package must be treated as compromised at the native-code level
  • *Cluster F - Base58 typosquat cluster (`base65- obfuscated payload + bs58-` boilerplate siblings, 9 packages): base65-11x, base65-12x, base65-13x, base65-15x, base65-33x, base65-77x each ship the legitimate base-x source followed by a ~123KB top-level obfuscated block that installs dispatchers on globalThis under registries vmr_3f4688 and vmw_bf472f, manipulates Object.defineProperty and __proto__ to intercept object operations, and calls fetch from inside the obfuscated block - runs unconditionally on require/import in both CJS and ESM. bs58-11, bs58-12, bs58-13 carry only boilerplate CWE-506 but the naming shift (base65-Nx vs bs58-N) strongly implies sibling drops from the same operator staging both base58-encoding-library typosquat registers in parallel. Any process that loaded a `base65- package must be considered runtime-hooked - the Object.defineProperty` monkey-patching means subsequent property reads/writes in the same process can be intercepted
  • Cluster G - Coordinated dep-confusion / OAST recon beacon wave (8 packages, multiple destinations): @dgn-src-click-to-pay-org/srcdcfreleasecert@999.0.1 and dcfarguscert@999.0.1 are dep-confusion probes targeting Discover / SRC (click-to-pay) payment infrastructure - both use inflated 999.0.1 versions, both beacon to bare-IP HTTP endpoints (dcfarguscert uses http://16-171-38-148.sslip.io:8080/api/install with full npm ls -g exfil; srcdcfreleasecert POSTs package + host metadata to a hardcoded bare-IP endpoint), and both include token/PAN-validation stub code as cover. bjm-low-code-components@99.0.0, chapters-core@9.999.999 (leaves a samsung-depconf-poc.json marker file), ghazaly@99.9.0, dependencyfsdsfdsfg@99.9.0 (identical xghhv5sajm33m7krgi4n8my0mrsig84x.oastify.com endpoint - same operator), and whs4_ued@1.0.0 (Discord webhook exfil, runtime string-concat token to evade detection) all beacon to Burp Collaborator OAST subdomains or Discord webhooks. zeal-rq-hooks@0.0.0 beacons to npm-canary.aveliscare.com. Blast radius per package is small (installer metadata only), but the concentration of Samsung/Discover/internal-scope dep-confusion probes on a single day suggests multiple red teams (or attackers) are actively enumerating internal scopes - if you operate at any named target org and see your @<org> scope resolving to a public package, escalate to internal security
  • Cluster H - sui-gql-client + sui-bcs-codec Sui blockchain typosquat pair: both carry only boilerplate CWE-506 on the GHSA pages ("fully compromised"), but naming targets the Sui blockchain's official @mysten/* scope - sui-gql-client typosquats @mysten/sui/graphql/client and sui-bcs-codec typosquats @mysten/bcs. Treat as capable of the same wallet-key theft / credential-exfil behaviour as the fully-analysed Cluster A ring until Socket or OpenSSF post the malicious-package sample
  • Cluster I - Boilerplate CWE-506 drops (9 packages, behaviour uncharacterised): internallib_v164, tsihealth-client, tilaver-mfa, developer-dashboard, fetch-runtime, vite-svg-parse, node-internal-svg-loader, lines-columns, dakumangalsingh_virus all ship the standard "any computer that has this package installed or running should be considered fully compromised" text without a differentiated behavioural analysis. Blast radius is not fully characterised - treat each as capable of the same credential-theft / remote-shell / wallet-drain behaviour as the fully-analysed batch members until Socket / OpenSSF post the malicious-package sample. Names imply targets: internallib_v164 and developer-dashboard are internal-scope dep-confusion lures; tilaver-mfa typosquats MFA tooling; fetch-runtime and lines-columns typosquat standard utilities; vite-svg-parse and node-internal-svg-loader typosquat Vite / Node SVG loader plugins

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the full 2026-08-11 package list below
  2. 2For any Cluster A match (@openzeppelin-4/contracts, @openzeppelin-5/contracts, @aerodrome-finance/contracts, @aerodrome-finance/slipstream, ethereum-vault-connector): assume every AWS credential, SSH key, .npmrc/.netrc token, Kubernetes config, Docker config, blockchain keystore (Foundry / Solana / Sui / gcloud), and every process.env value matching the KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/AWS/GITHUB/NPM/WALLET filter has been exfiltrated to webhook.site. Rotate every credential accessible to the host during the exposure window, drain every wallet whose private key or seed phrase lived on the host, and re-image the host from bare metal. Correct the typo to the intended package (@openzeppelin/contracts for the OZ ring; @aerodrome-finance/* maps to the real Aerodrome Finance packages published under a legitimate Aerodrome scope; ethereum-vault-connector maps to the Euler Labs Ethereum Vault Connector repo). Because the exfil fires as a detached child process with a randomised 60-240 second delay, install-time scanners that watch only the install process itself will miss it - correlate outbound flow logs during the 4-minute window after any Cluster A install
  3. 3For safe-local-env-loader matches (Cluster B - dotenv impersonator RAT): same posture as the 2026-08-10 env-local remediation. Re-image the affected Windows or macOS host from bare metal, remove %APPDATA%\ScreenCaptureClient and the HKCU\...\Run\ScreenCaptureClient registry entry (Windows), remove any equivalent launch-agent plist (macOS), treat every credential entered on the host during the exposure window as compromised, and block outbound to 192.99.204.157:5000 at the network egress. Correct the typo to the real dotenv
  4. 4For newtun matches (Cluster C - WebSocket PTY RAT): block outbound to pull.7ii.win:7999 at the network egress immediately - the WebSocket is unencrypted, so the connection can be terminated at a plain TCP filter. Kill any process holding an outbound connection to that endpoint. Rotate every credential on the host, uninstall the global self-updated versions of newtun (npm uninstall -g newtun on every host), and re-image. Because the RAT self-updates without user approval, a stale removal that leaves the WebSocket running will re-install fresh binaries
  5. 5For svelte-vim-kit / kit-vim-map matches (Cluster D - map-streak-kit family): same remediation as 2026-08-08 map-streak-kit and 2026-08-10 svelte-kit-streak/kit-map-streak. Re-image the affected Linux host from bare metal, rotate every SSH key on the host, rotate every credential stored in env/config files, remove any systemd unit created in the exposure window. Third consecutive daily drop from this operator - the naming register is now <framework>-<editor>-kit and kit-<editor>-map; block that morphology in your name-scanner if you can
  6. 6For @nzeros/codebreak matches (Cluster E - Go ELF disguised as C solver): uninstall, delete the vendor/ directory contents (in particular the 33.6MB solver-linux-x64 and solver-darwin-x64 binaries), hunt for the postinstall-spawned process, and treat any Linux x64 host or CI runner that installed the package as compromised at the native-code level. The Mach-O darwin-arm64 binary is legitimate but do not use it as evidence the package is safe - the Linux binary loaded network + process-execution + crypto libraries
  7. 7*For any `base65- match (Cluster F - base-x typosquat with runtime Object.defineProperty hook)**: because the obfuscated payload monkey-patches Object.defineProperty and __proto__ at load time, **any subsequent property read/write in the same Node process can be intercepted**. Rotate any credentials or private keys that lived in memory during the process's lifetime, kill any long-running Node process that loaded the package, and audit outbound flow logs for the fetch calls the obfuscated payload makes. For bs58-* matches: block the name and correct to the real bs58 package. Prefer the vendor-official base-x` for base-N encoding needs
  8. 8For any Cluster G recon-beacon match: internal-scope reconnaissance data (hostname, username, cwd, npm ls -g global-package inventory, IPv4 addresses) has already been exfiltrated. Configure .npmrc scope-to-registry mapping so @dgn-src-click-to-pay-org/*, @bjm/*, and other internal scopes resolve only from your private mirror. If you operate inside Discover / SRC / Samsung / any of the named target organisations, escalate to internal security - multiple actors are actively enumerating your internal scopes. Rotate any credential that might be inferable from the exfil (hostname + npm-installed-package list gives an operator a full attack surface map)
  9. 9For sui-gql-client / sui-bcs-codec matches (Cluster H - Sui typosquat pair): uninstall, correct the typo to the real @mysten/sui / @mysten/bcs, and treat as capable of the same wallet-key theft / credential-exfil behaviour as Cluster A until Socket or OpenSSF post the malicious-package sample
  10. 10For all Cluster I boilerplate matches: uninstall, block the name in .npmrc, correct the typo to the intended package. Because the behavioural analysis is incomplete, prefer the full-compromise remediation posture (rotate credentials, re-image the host) unless a subsequent Socket/OpenSSF post narrows the risk
  11. 11For all npm installs in CI, run with --ignore-scripts as defense-in-depth to prevent postinstall/preinstall payloads (mitigates Clusters A, B, C, E, G; does NOT mitigate F, which fires on require/import at runtime)
  12. 12Verify none of the 2026-08-11 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
npm-2026-08-11-ghsa-malware-sweep