GitHub Advisory npm CWE-506 sweep - 2026-08-14 batch (~27 packages: `jchunt.top` telemetry-canary day-2 `xrblocks-mcp`, `preinstall-hook-webhook-callback-demo` webhook.site demo, `@secauditb20y/sec-test-r3b` self-labeled sec-test POC, `webautomation_js` + `@ferudionz/*` obfuscator.io RC4 runtime exfil trio, `@guangnao/agent-proxy` Claude/Codex credential monetizer to `hub.client-llm.com`, `@lodash-js/lodash-js` Xelis miner, `@divineubg/divine` ntfy.sh EventSource C2, `@demopack/www` iOS iframe exploit injector, `@ghost_debugger/nanocache` hidden Windows binary launcher, `datefmt-simple-utils` reverse shell to `8.135.48.40:4444`, `registrynpmjs.to` typosquat cluster (`@polymarkets/clob-client-v2`, `@devmikets/hyperliquid-sdk`), Brazilian `alelo-*` dep-confusion cluster to `209.99.185.109`, plus `@peptideventure/*`, `@mexc/shared-utils`, `sui-gql-lite`, `bcs-mini`)

What happened

On 2026-08-14, the GitHub Advisory Database published at least 27 new npm CWE-506 (Embedded Malicious Code) advisories (this record initially covered only the first 4 named clusters and was backfilled 2026-08-15 with the remaining ~22 packages once GHSA re-indexed the full day). The most notable single item is a continuation of the jchunt.top telemetry-canary operator series established the day before; the day also brings a Claude/Codex credential monetizer, an active Xelis cryptominer, an EventSource-C2 backdoor, a reverse-shell dropper, a registrynpmjs.to typosquat mini-wave, and a Brazilian Alelo-scope dependency-confusion cluster.

Cluster A - jchunt.top telemetry-canary series day-2

| Package | Versions | GHSA | Endpoint | |---|---|---|---| | xrblocks-mcp | 6.3.1 | GHSA-pwwg-f86j-hmv7 | 6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp |

Same per-package-subdomain *.instances.poc.jchunt.top operator pattern as 08-13 wct-st and tizen-webdriver-cli. Postinstall collects hostname/platform/arch/Node-version/package-name/ISO-timestamp, HTTPS-POSTs to package-specific subdomain, silent error suppression. Naming targets xrblocks (WebXR block libraries) and the MCP (Model Context Protocol) tooling ecosystem.

Cluster B - preinstall-hook-webhook-callback-demo webhook.site preinstall demo

| Package | Versions | GHSA | |---|---|---| | preinstall-hook-webhook-callback-demo | 1.0.0, 1.0.1 | GHSA-9j5p-xwfm-m987 |

Preinstall HTTPS-callback to webhook.site. Self-labeled demo but executes unconditionally. Same webhook.site preinstall exfil register as 08-13 Cluster D @khaznatech/* and 08-12 Cluster G mcp-util-helpers - the webhook.site register is now a daily-recurring operator class.

Cluster C - @secauditb20y/sec-test-r3b self-labeled sec-test proof-of-execution POC

| Package | Versions | GHSA | |---|---|---| | @secauditb20y/sec-test-r3b | 1.0.0 | GHSA-whmg-4w65-37cm |

Postinstall node -e invoking fs.writeFileSync to /tmp/PWN_R3REAL/FIRED. Package main exports only the literal 42. Self-identifies as authorized security test - advisory judges the labeling non-mitigating and treats it as malware.

Cluster D - webautomation_js obfuscator.io RC4 runtime exfil

| Package | Versions | GHSA | |---|---|---| | webautomation_js | 1.0.0, 1.0.1 | GHSA-v4hj-5v4c-hpx9 |

Obfuscator.io RC4 string-array + self-defending debugger-check wrapper. Exported function transmits caller-supplied arguments to a runtime-reconstructed URL - both the axios module reference and every URL fragment remain encrypted in the source. Advertised as "logger tool for validation entry"; actual behavior is unauthorized runtime data exfil. This is the only 08-14 cluster whose exfil fires at runtime rather than install-time - the exposure window is every call site, not just npm install, so --ignore-scripts does not mitigate.

Cluster E - @guangnao/agent-proxy Claude/Codex credential monetizer

| Package | Versions | GHSA | C2 | |---|---|---|---| | @guangnao/agent-proxy | 1.2.1, 1.4.0, 1.4.2 | GHSA-p2xx-33v2-xwcj | hub.client-llm.com (WebSocket) |

On agent-proxy start, opens a WebSocket to a runtime-decoded endpoint (XOR+base64 with key gnP2p!7xQ from dist/cli.js), accepts remote job messages, and forwards them to api.anthropic.com (Claude) or ChatGPT/Codex upstreams using the installer's on-disk OAuth credentials. Streams responses back to the operator. Gated by onlyIfCredentialed so only hosts with active paid-tier Claude/Codex logins are monetised. Compromises the developer's account and violates vendor ToS.

Cluster F - @lodash-js/lodash-js Xelis cryptominer

| Package | Versions | GHSA | C2 | |---|---|---|---| | @lodash-js/lodash-js | 0.1.0, 0.2.0, 0.3.0 | GHSA-6gwm-c74j-jfv9 | analytics.baskirill-an.workers.dev/configs/boostydownloader, api.ipify.org |

Xelis Stratum miner auto-instantiates on import. Fetches mining config from a Cloudflare Workers subdomain, captures visitor IP via ipify. Typosquats the lodash namespace via the @lodash-js scope.

Cluster G - @divineubg/divine ntfy.sh EventSource C2

| Package | Versions | GHSA | C2 | |---|---|---|---| | @divineubg/divine | ≤ 1.0.5 | GHSA-w83g-7xwj-mmqx | ntfy.sh/dv-141u30-admin-cmd-/sse, ntfy.sh/dv-141u30-admin-status- |

Exported listen() opens an EventSource to a public ntfy.sh channel, receives attacker JavaScript, evaluates it, and posts results back. Ntfy is a legitimate public pub/sub service - blocking ntfy.sh from application egress is a reasonable defense-in-depth.

Cluster H - registrynpmjs.to typosquat wave

| Package | Versions | GHSA | Rogue registry | |---|---|---|---| | @polymarkets/clob-client-v2 | ≤ 1.0.6 | GHSA-xq4g-rv84-pcvv | registrynpmjs.to | | @devmikets/hyperliquid-sdk | ≤ 1.9.6 | GHSA-qw2c-ff44-52xq | registrynpmjs.to |

Both packages declare their inquirer dependency via a tarball URL pointing at the lookalike registry registrynpmjs.to (typosquats registry.npmjs.org). npm installs the tarball directly, so a compromised or attacker-controlled registry serves arbitrary lifecycle-script code as a transitive dependency. Block registrynpmjs.to at DNS. Same pattern as 08-12 @polymarketstest/clob-client.

Cluster I - @demopack/www iOS iframe exploit injection

| Package | Versions | GHSA | Payload | |---|---|---|---| | @demopack/www | 0.0.12 | GHSA-g447-2pwf-9jh2 | cdn.jsdelivr.net/npm/@cdnshell/loader/a188ps10.js, unpkg.com/@themepack/dark/ah3zhsl.html |

Disguised as static assets. iOS user-agent detection triggers a hidden iframe loading remote HTML via unpkg.com/@themepack/dark. Chinese comments describe a "primitive injection module" and sandbox testing. Non-iOS visitors unaffected; any site bundling this exposes its iOS users.

Cluster J - @ghost_debugger/nanocache hidden Windows binary launcher

| Package | Versions | GHSA | Binary | |---|---|---|---| | @ghost_debugger/nanocache | 0.1.1 | GHSA-q5p2-m4qf-x2cr | vendor/nanocache.exe (1.1 MB, detached, child.unref()) |

On import, spawns a bundled vendor/nanocache.exe (not built from source in the tarball) with hidden-window flags and detaches it. Binary strings include "/ws/agent", "disconnect", "update", "exit_code" - a WebSocket-based remote-control agent. Masquerades as an in-memory LRU/TTL cache.

Cluster K - datefmt-simple-utils reverse shell

| Package | Versions | GHSA | C2 | |---|---|---|---| | datefmt-simple-utils | 1.0.0 | GHSA-8hx5-vj8g-mqv7 | 8.135.48.40:4444 (TCP, /bin/bash) |

postinstall.js opens a TCP socket to 8.135.48.40:4444 and attaches an interactive /bin/bash (with Python and Node fallbacks). Actual date-formatting functionality is non-functional.

Cluster L - alelo-* Brazilian Alelo dep-confusion cluster

| Package | Versions | GHSA | Exfil | |---|---|---|---| | alelo-common | 99.0.0 | GHSA-4w9c-fcxm-hf28 | 209.99.185.109/preinstall, /postinstall | | alelo-core | 99.0.0, 99.0.1, 99.0.2 | GHSA-pwg9-w9cr-cg23 | same | | alelo-client | 99.0.0, 99.0.2 | GHSA-v865-m9wp-5xhc | same | | alelo-utils | 99.0.0 | GHSA-chg6-4g6x-82gw | same | | alelo-services | 99.0.0, 99.0.2 | GHSA-f9gp-j44v-7447 | same | | alelo-payment | 99.0.0, 99.0.2 | GHSA-4whx-hjpv-g8xf | same | | meualelo | 99.0.0 | GHSA-m6g5-fpx6-6x7v | same |

Alelo is a large Brazilian benefits/payments company. All seven packages published at version 99.x (classic dependency-confusion high-version tactic), publisher oxy12@proton.me. Preinstall exfiltrates hostname, username, platform, cwd, and full process.env over HTTPS with rejectUnauthorized:false; postinstall additionally reads .npmrc, .env, and package.json and runs whoami/id. All traffic goes to bare-IP 209.99.185.109 - a straightforward network-block indicator. If you work at Alelo or a downstream vendor, treat internal npm publish tokens as burned.

Cluster M - @ferudionz/* obfuscator.io RC4 runtime exfil pair (Cluster D siblings)

| Package | Versions | GHSA | Behavior | |---|---|---|---| | @ferudionz/webautomation | ≤ 1.0.0 | GHSA-66vf-3wp7-7x3j | connet(x) POSTs caller arg to runtime-reconstructed URL | | @ferudionz/web_logger_js | 1.0.0 | GHSA-wjf7-fv2q-889h | connet(x) GETs to runtime-reconstructed URL, evm_account install target |

Same exfil pattern as Cluster D webautomation_js: obfuscator.io RC4 string-array + self-defending debugger-check wrapper, destination URL and axios reference reconstructed at runtime from ~130 encoded literals across ~13 fragments. web_logger_js documentation says npm install evm_account - the name mismatch flags EVM/crypto address exfil targeting.

Cluster N - miscellaneous single-package advisories

| Package | Versions | GHSA | Note | |---|---|---|---| | @mexc/shared-utils | 1.0.0 | GHSA-r6r5-5xmc-9642 | Dep-confusion POC - postinstall writes marker os.tmpdir()/mexc-poc-execution-proof.json, no network | | @peptideventure/peptide-score-modifier | >= 0 | GHSA-jw4c-f75m-9wfj | Generic malware, no technical detail in advisory | | @peptideventure/peptide-unit | >= 0 | GHSA-73vr-mf4r-r3p5 | Generic malware, no technical detail in advisory | | sui-gql-lite | >= 0 | GHSA-r92j-xvgv-4q9c | Generic malware, Sui blockchain typosquat pattern | | bcs-mini | >= 0 | GHSA-9q3f-qc6p-62mm | Generic malware, Sui bcs (Binary Canonical Serialization) typosquat pattern |

Registry state

All ~27 packages yanked or security-holding-replaced from npm during the 2026-08-14/15 takedown window. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

Related tracked activity

• jchunt.top telemetry-canary series (Cluster A): day-2 continuation of 08-13 wct-st/tizen-webdriver-cli - same per-package-subdomain routing on *.instances.poc.jchunt.top.
• webhook.site preinstall exfil register (Cluster B): recurring class - 08-12 mcp-util-helpers, 08-13 @khaznatech/*, 08-14 preinstall-hook-webhook-callback-demo.
• registrynpmjs.to typosquat wave (Cluster H): builds on the 08-12 @polymarketstest/clob-client sighting of the same rogue registry.
• Obfuscator.io RC4 runtime-exfil operator (Clusters D and M): three packages now share the connet(x) runtime-reconstructed-URL pattern.
• Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, amazon-inspector. No named threat actor.

Affected packages (26)

Impact

• Cluster A - jchunt.top telemetry-canary series day-2 (1 new package xrblocks-mcp): xrblocks-mcp@6.3.1 postinstall collects hostname/platform/arch/Node-version/package-name/ISO-timestamp and HTTPS-POSTs to a hardcoded package-specific endpoint https://6cjhdzmo.instances.poc.jchunt.top/xrblocks-mcp. Same per-package-subdomain *.instances.poc.jchunt.top operator pattern as 08-13 wct-st and tizen-webdriver-cli. The README self-labels as a "security research canary" but transmits identifying host data unrelated to any stated xrblocks-mcp (WebXR MCP tooling) functionality and remains classified as malware by GHSA. Data exfiltrated is limited (hostname/platform/arch/Node version) but confirms the operator can enumerate hosts pulling the package - if you use xrblocks WebXR blocks or MCP tooling, uninstall and audit
• Cluster B - preinstall-hook-webhook-callback-demo webhook.site preinstall demo (1 package, 2 versions): preinstall-hook-webhook-callback-demo@1.0.0,1.0.1 runs a preinstall script that HTTPS-callbacks to webhook.site (an ephemeral request-capture service commonly used as an attacker-controlled exfil sink). Self-labeled demo but executes unconditionally on install - the "demo" label is not mitigating. Same webhook.site preinstall exfil register as 08-13 Cluster D @khaznatech/*
• Cluster C - @secauditb20y/sec-test-r3b self-labeled sec-test proof-of-execution POC (1 package): @secauditb20y/sec-test-r3b@1.0.0 postinstall runs node -e invoking fs.writeFileSync to create /tmp/PWN_R3REAL/FIRED on the installer's machine. Package main module exports only the literal value 42 - no legitimate reason for install-time filesystem writes. Self-identifies as an authorized security test in metadata but the advisory notes this labeling is non-mitigating and functionally equivalent to malware dropper behavior. Writing outside the package directory demonstrates arbitrary-write RCE primitive
• Cluster D - webautomation_js obfuscator.io RC4 runtime exfil with hidden URL (1 package, 2 versions): webautomation_js@1.0.0,1.0.1 index.js uses obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The exported function accepts caller-supplied arguments and sends them to a hidden, attacker-controlled endpoint whose destination URL is reconstructed at runtime from the RC4-encoded string array - the destination is not visible in normal source code. Both the axios module name and every fragment of the destination URL remain encrypted until execution. Advertised as "logger tool for validation entry"; actual behavior is unauthorized runtime exfil of any data passed to the function. Any code path invoking the exported function unknowingly transmits data to the operator - broader than an install-time exfil because the data being exfiltrated is caller-supplied (potentially payloads, credentials, form data) at runtime

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the full 2026-08-14 package list below
2. 2For xrblocks-mcp matches (Cluster A - jchunt.top telemetry day-2): uninstall, correct to the real xrblocks WebXR library or your intended MCP tooling package, block outbound to *.instances.poc.jchunt.top at the network edge (same operator pattern as 08-13 wct-st/tizen-webdriver-cli - block covers both days)
3. 3For preinstall-hook-webhook-callback-demo matches (Cluster B): uninstall - block outbound to webhook.site from build hosts as defense-in-depth against the broader webhook.site preinstall exfil register (same class as 08-13 @khaznatech/* and 08-12 mcp-util-helpers)
4. 4For @secauditb20y/sec-test-r3b matches (Cluster C): uninstall and delete /tmp/PWN_R3REAL/FIRED on any affected host - the write is a marker, but the RCE primitive it demonstrates means the operator could have written arbitrary content at that path. If you operate secauditb20y as an npm publisher or scope owner, escalate - the "sec test" label is used unauthorised in the advisory's judgement
5. 5For webautomation_js matches (Cluster D - obfuscator.io RC4 runtime exfil): uninstall immediately. Do not assume this is install-time-only - the exfil fires every time the exported function is called at runtime, so any data passed to the function during the exposure window has been transmitted to the operator. Audit call sites for what data was passed, rotate any credentials/tokens/form data / user input that may have flowed through the function, and block outbound to axios runtime destinations you cannot account for
6. 6For all npm installs in CI, run with --ignore-scripts as defense-in-depth (mitigates Clusters A/B/C - does NOT mitigate D which fires at runtime on caller invocation)
7. 7Verify none of the 2026-08-14 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-pwwg-f86j-hmv7 - xrblocks-mcp (jchunt.top telemetry day-2)

  github.com
  GitHub
• GHSA-9j5p-xwfm-m987 - preinstall-hook-webhook-callback-demo (webhook.site preinstall exfil)

  github.com
  GitHub
• GHSA-whmg-4w65-37cm - @secauditb20y/sec-test-r3b (/tmp/PWN_R3REAL/FIRED proof-of-execution)

  github.com
  GitHub
• GHSA-v4hj-5v4c-hpx9 - webautomation_js (obfuscator.io RC4 runtime exfil)

  github.com
  GitHub
• GHSA-6r3v-5c9p-jv7v - wct-st (08-13 jchunt.top telemetry sibling)

  github.com
  GitHub
• GHSA-p2xx-33v2-xwcj - @guangnao/agent-proxy (Claude/Codex credential monetiser)

  github.com
  GitHub
• GHSA-6gwm-c74j-jfv9 - @lodash-js/lodash-js (Xelis miner)

  github.com
  GitHub
• GHSA-w83g-7xwj-mmqx - @divineubg/divine (ntfy.sh EventSource C2)

  github.com
  GitHub
• GHSA-xq4g-rv84-pcvv - @polymarkets/clob-client-v2 (registrynpmjs.to typosquat)

  github.com
  GitHub
• GHSA-qw2c-ff44-52xq - @devmikets/hyperliquid-sdk (registrynpmjs.to typosquat)

  github.com
  GitHub
• GHSA-g447-2pwf-9jh2 - @demopack/www (iOS iframe exploit injection)

  github.com
  GitHub
• GHSA-q5p2-m4qf-x2cr - @ghost_debugger/nanocache (hidden Windows binary launcher)

  github.com
  GitHub
• GHSA-8hx5-vj8g-mqv7 - datefmt-simple-utils (reverse shell 8.135.48.40:4444)

  github.com
  GitHub
• GHSA-pwg9-w9cr-cg23 - alelo-core (Brazilian Alelo dep-confusion cluster)

  github.com
  GitHub
• GHSA-66vf-3wp7-7x3j - @ferudionz/webautomation (obfuscator.io RC4 sibling)

  github.com
  GitHub
• GHSA-wjf7-fv2q-889h - @ferudionz/web_logger_js (obfuscator.io RC4 sibling, evm_account target)

  github.com
  GitHub
• GHSA-r6r5-5xmc-9642 - @mexc/shared-utils (dep-confusion POC)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub