DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 15 Aug 2026Updated 16 Aug 202622 packages · 57 versions

GitHub Advisory npm CWE-506 sweep - 2026-08-15 batch (`@velliajs/discord` `discord.js` impersonator with hardcoded GitHub PAT + hidden `_verifyAuthorization` kill-switch, `akamai(js)-sensor` Google-Calendar invisible-Unicode C2 trio, HackerOne/Twilio `*-probe`/`*-poc` bug-bounty-canary droppers with live payloads, `depcruise-*` + `gunzip-js` `99.9.1` dependency-confusion canary, `@wololasod/tiny-id` RC4 Windows/Linux dropper, `@finaxis/common-js` Xelis miner, `*-vim` naming-canary pair, plus IP/webhook exfiltrators)

Summary

22 npm CWE-506 advisories published 2026-08-15 - the day's headline is @velliajs/discord@1.0.3..1.0.7, a discord.js impersonator with two live hardcoded GitHub PATs, an unpinned private-repo sysframe dependency the operator can hot-swap, and a hidden Client.login() _verifyAuthorization allowlist kill-switch. Same-day clusters include a 3-package akamai(js)-sensor Google-Calendar-dead-drop trio using invisible-Unicode payloads, HackerOne/Twilio *-probe/*-poc bug-bounty-canary droppers with real credential exfil, a depcruise-* + gunzip-js 99.9.1 OpenSSF-domain-flagged canary group, @wololasod/tiny-id RC4 dropper, @finaxis/common-js Xelis miner, adxaa WordPress account-takeover, and a matching *-vim naming-canary pair.

typosquatcredential-theftaccount-takeoverobfuscationdependency-confusioncdn-supply-chain
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis
Also known as
2026-08-15 GHSA npm batch · *-vim naming-canary pair · akamai(js) Google-Calendar C2 trio · HackerOne/Twilio bug-bounty-canary droppers · depcruise 99.9.1 dep-confusion canary
Ecosystems
npm
Packages tracked
22

What happened

On 2026-08-15, the GitHub Advisory Database published 22 new npm CWE-506 (Embedded Malicious Code) advisories - initially indexed as a quiet 3-package day, backfilled 2026-08-16 to the full 22-package count as OpenSSF Package Analysis and the GHSA reviewer queue caught up.

Cluster A - @velliajs/discord discord.js impersonator with hardcoded GitHub PAT + hidden _verifyAuthorization kill-switch

| Package | Versions | GHSA | Behavior | |---|---|---|---| | @velliajs/discord | 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 | GHSA-5546-mfxg-3v4r | Two live hardcoded GitHub PATs; unpinned sysframe private-repo dep fetched via PAT; hidden Client.login() _verifyAuthorization allowlist fetched via second PAT |

The hardcoded PATs are the operator's primary lever - they give a single account write access to the sysframe private repository, so the operator can hot-swap the runtime dependency at any time and deliver arbitrary code (including lifecycle scripts) at every subsequent install. The _verifyAuthorization allowlist doubles as a hidden kill-switch (the bot silently refuses to run unless the caller is whitelisted) and as a beacon that fires on every Client.login() call to enumerate live installations. This is a more targeted design than a generic dropper: the operator can quietly gate execution against specific victims while the majority of accidental installers see nothing happen.

The impersonation target is discord.js, the ubiquitous Discord bot library - a classic install-time confusion vector for anyone typo-installing a scoped variant.

Cluster B - akamai(js)-sensor Google-Calendar-dead-drop invisible-Unicode C2 trio

| Package | Versions | GHSA | Behavior | |---|---|---|---| | akamai-sensor | 1.0.0 | GHSA-5rgj-m8xx-vvvj | Invisible-Unicode payload in index.js decoded and executed via new Function() on sensor() call; Google Calendar ICS feed dead-drop | | akamaijs-sensor | 2.0.0, 3.0.0 | GHSA-86x5-fp9h-hxg3 | Same invisible-Unicode + new Function() + Google Calendar C2 pattern; sync-metrics.js decoder | | akamaijs-sensorv1 | >= 3.0.0 | GHSA-vf6f-mfc3-9548 | Same pattern; parses ICS event descriptions for base64 URLs rewritten to /generate |

All three impersonate Akamai's Bot Manager sensor_data SDK. The invisible-Unicode payload is steganographic - the file looks like ordinary JavaScript in any editor that doesn't highlight variation-selector characters, and the payload only materialises when the decoder runs at call time (not at import time), which evades scanners that only inspect top-level module code. The Google Calendar ICS feed as C2 is a nasty choice: calendar.google.com is allow-listed on virtually every corporate egress firewall, and the attacker can rotate the actual malicious endpoint by editing the calendar event without ever touching the package again.

Cluster C - HackerOne / Twilio *-probe / *-poc bug-bounty-canary droppers with LIVE payloads

| Package | Versions | GHSA | Behavior | |---|---|---|---| | hunterone-build-probe-9210 | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 | GHSA-7vcv-c883-w3f6 | Install-hook probe.js collects hostname/platform/net-ifaces/env vars/AWS creds (~/.npmrc, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI); POSTs to webhook | | twilio-hackerone-poc-afe6937c | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 | GHSA-967c-3f68-4gxj | Preinstall/postinstall reconnaissance + AWS Lambda env vars + persistent temp-dir-watching daemon + cross-tenant node_modules injection | | tw-pkgprobe-7731 | 1.0.0, 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1 | GHSA-449r-r4hm-3v9g | Twilio Serverless-targeted background daemon + account-ID scan + cross-tenant token capture; falsely brands as authorised security research tool |

All three abuse the ambient trust that comes with bug-bounty-flavoured naming (hackerone, hunterone, HackerOne-style -poc-<hex> suffix). Defenders who spot the install may hesitate to remove it, assuming it belongs to an authorised researcher. The payload is a real dropper: AWS ECS + Lambda credential paths + ~/.npmrc tokens shipped to an anonymous webhook.

Cluster D - depcruise-* + gunzip-js 99.9.1 dependency-confusion canary group

| Package | Versions | GHSA | Behavior | |---|---|---|---| | depcruise-wrap-stream-in-html | 99.9.1 | GHSA-8r7w-6hqf-4x5p | Runtime dependency ltidisafe fetched from arbitrary Google Cloud Storage tarball URL; bucket owner can swap contents at any time without republishing | | depcruise-fmt | 99.9.1 | GHSA-29c8-59h2-f6pq | OpenSSF Package Analysis: contacts domain associated with malicious activity | | depcruise-baseline | 99.9.1 | GHSA-944r-8f8q-66p7 | OpenSSF Package Analysis: contacts domain associated with malicious activity | | gunzip-js | 99.9.1 | GHSA-ff3p-88cr-hc25 | OpenSSF Package Analysis: contacts domain associated with malicious activity |

All four share the tell-tale 99.9.1 version - the "outrun-the-real-version" tactic for dependency-confusion attacks against internal registries that resolve to the highest available version. Three names shadow dependency-cruiser helper conventions; the fourth shadows a legitimate gunzip-js primitive.

Cluster E - kit-hydration-vim + svelte-goal-vim *-vim naming-canary uncharacterised pair

| Package | Versions | GHSA | Behavior | |---|---|---|---| | kit-hydration-vim | >= 0 (all versions) | GHSA-g9cm-v642-m5rj | Generic GHSA malware boilerplate, no per-package detail | | svelte-goal-vim | >= 0 (all versions) | GHSA-qx34-66jv-3pg5 | Generic GHSA malware boilerplate, no per-package detail |

The shared *-vim naming across two same-day publications strongly suggests one operator running a naming-canary sweep against Svelte / SvelteKit / Vim adjacent namespaces. No IOCs published; treat as arbitrary malware.

Cluster F - Cross-target singletons

| Package | Versions | GHSA | Behavior | |---|---|---|---| | @wololasod/tiny-id | 0.1.0, 0.1.1, 0.1.2, 0.1.3 | GHSA-5mh7-hwqc-6rxw | obfuscator.io + RC4 VM; downloads Windows/Linux binary to %APPDATA% / temp; VBS launcher on Windows, detached spawn on Linux; payload hidden in .d.ts | | @openrepl/shared | 0.0.4, 0.0.5 | GHSA-2253-v578-ppx8 | preinstall shells out to public request-inspection service with username + hostname | | autbank-core | 99.0.0, 99.0.2 | GHSA-96pg-c3cg-m9h7 | Preinstall env-var scan for API-key/secret/token substrings + .env + package.json, POST to webhook; postinstall backup exfil | | adxaa | 1.0.0 | GHSA-3394-pf38-xc3x | WordPress domain-gated payload for noviembrenacional.com; exfiltrates HTML + username, deletes account, hijacks via ProtonMail email swap + password reset | | @finaxis/common-js | <= 0.3.4 (0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4) | GHSA-cxv6-5ffv-7w2g | Obfuscated lodash-lookalike shipping a Xelis (XEL) proof-of-work miner; stratum client + Web Worker + embedded WASM | | fastly-vcl-language-client | 1.0.0 | GHSA-c94r-gh3m-qm4g | Preinstall exfil of public IP + hostname + CI env vars (GitHub Actions) via webhook + DNS | | upload-to-gcp | 3.2.1 | GHSA-jx3f-5x53-4484 | Postinstall exfil of host + platform + arch + Node + pkg metadata to z5owtt3g.instances.poc.jchunt.top/upload-to-gcp | | require-i18next | 20.0.0, 21.0.0 | GHSA-4m9p-v3v7-c5xh | OpenSSF: contacts malicious domain and executes command | | harmony-app-toolkit | 21.0.0, 22.0.0 | GHSA-qp2p-qrmg-36rq | OpenSSF: contacts malicious domain and executes command |

Registry state

All 22 packages yanked or security-holding-replaced from npm during the 2026-08-15 through 2026-08-16 takedown window. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

Related tracked activity

  • 08-14 backfill context: the 08-14 sweep covered ~27 packages including the Claude/Codex credential monetiser @guangnao/agent-proxy, the registrynpmjs.to typosquat wave, and the Brazilian alelo-* dep-confusion cluster.
  • Hardcoded-GitHub-PAT impersonators (Cluster A): a variant of the credential-embedded delivery pattern - the sysframe private-repo trick makes this a live-update malware channel rather than a one-shot dropper.
  • Google-Calendar dead-drop C2 (Cluster B): joins the small-but-growing family of allow-listed-SaaS-as-C2 supply-chain attacks; similar to Zulip, Slack webhooks, and Notion abuse seen in earlier 2026 waves.
  • HackerOne/Twilio-brand canaries (Cluster C): differ from the pure OSSF research-canary group in that they ship real functional droppers, not passive beacons.
  • 99.9.1 dependency-confusion canary (Cluster D): recurring signature we've seen in previous internal-namespace sweeps.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis. No named threat actor.

Affected packages (22)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.json

Impact

  • Cluster A - @velliajs/discord discord.js impersonator with hardcoded GitHub PAT + hidden kill-switch (1 package, 5 versions): @velliajs/discord@1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7 impersonates the popular discord.js library. Two live hardcoded GitHub Personal Access Tokens are embedded in the package source. package.json declares a runtime dependency on sysframe fetched from a private GitHub repository via one of the embedded PATs - the repository is unpinned, so its author can rewrite it at any time and deliver arbitrary code (including lifecycle scripts) at every install. Client.login() runs an undocumented _verifyAuthorization routine that fetches an allowlist from a hardcoded GitHub URL using the second PAT, and the bot refuses to operate unless the caller is whitelisted - this is a hidden runtime kill-switch that both gives the operator remote enable/disable control and forces every running installation to beacon out on startup. Impact if consumed: sysframe code executes with the calling app's privileges; the beacon leaks the fact that the caller is running the package plus any environment data attached to the allowlist check; the operator can gate execution to specific targets
  • Cluster B - akamai(js)-sensor Google-Calendar-dead-drop invisible-Unicode C2 trio (3 packages, 4 versions): akamai-sensor@1.0.0, akamaijs-sensor@2.0.0, 3.0.0, akamaijs-sensorv1@>=3.0.0 all impersonate the legitimate Akamai Bot Manager sensor_data anti-bot SDK. All three conceal executable JavaScript inside index.js using invisible Unicode variation-selector and tag characters, then decode them at runtime and execute via new Function() when the sensor() API is called. The dead-drop channel is a hardcoded public Google Calendar ICS feed: the packages parse event descriptions, extract base64-encoded URLs, rewrite them to /generate endpoints, and fetch commands - the operator changes the target endpoint by editing calendar events, no republish needed. This is a mutable, hard-to-block C2 channel (calendar.google.com is allowlisted almost everywhere). Impact: full RCE within the calling Node process on any host that instantiates the fake sensor
  • *Cluster C - HackerOne / Twilio `-probe / -poc` bug-bounty-canary droppers with LIVE payloads (3 packages, 21 versions): hunterone-build-probe-9210@1.0.0..1.0.7, twilio-hackerone-poc-afe6937c@1.0.0..1.0.4, tw-pkgprobe-7731@1.0.0..1.1.1 masquerade as authorised bug-bounty research probes but ship real install-time droppers. All three chain preinstall/postinstall hooks to collect hostname, platform, network interfaces, environment variables, AWS credentials (~/.npmrc auth tokens, AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, AWS Lambda environment variables), and Twilio account identifiers, then POST them to an external webhook collector. tw-pkgprobe-7731 and twilio-hackerone-poc-afe6937c additionally deploy a persistent background daemon that watches temp dirs and performs cross-tenant injection* by writing malicious modules into other accounts' node_modules directories. Impact: installer-owned secrets shipped to an anonymous third-party collector at install time, plus lateral movement in multi-tenant CI/serverless environments
  • *Cluster D - `depcruise- + gunzip-js 99.9.1 dependency-confusion canary group (4 packages, 4 versions)**: depcruise-wrap-stream-in-html@99.9.1, depcruise-fmt@99.9.1, depcruise-baseline@99.9.1, gunzip-js@99.9.1 all share the suspicious 99.9.1 marker version - the classic dep-confusion outrun-the-real-version signal. depcruise-wrap-stream-in-html explicitly declares a runtime dependency on ltidisafe fetched from an arbitrary Google Cloud Storage tarball URL, letting the bucket owner swap the payload contents without republishing to npm. The others (depcruise-fmt, depcruise-baseline, gunzip-js) were flagged by OpenSSF Package Analysis because they contact a domain associated with malicious activity. All three depcruise-* names shadow the popular dependency-cruiser toolkit's helper namespace; gunzip-js shadows a real gunzip helper. Impact: install-time RCE via the swappable GCS tarball on the wrap-stream` variant; unknown-specific C2 on the OpenSSF-flagged siblings; treat all four as arbitrary malware
  • *Cluster E - `-vim naming-canary uncharacterised pair (2 packages)**: kit-hydration-vim and svelte-goal-vim carry only the GHSA generic-malware boilerplate. The shared *-vim` naming across two same-day publications strongly suggests one operator running a naming-canary sweep against Svelte / SvelteKit / Vim-adjacent namespaces
  • Cluster F - Cross-target singletons (9 packages, 15 versions): @wololasod/tiny-id@0.1.0..0.1.3 (obfuscator.io + RC4 VM that downloads a Windows/Linux platform-specific executable to %APPDATA% / temp, launches via VBS on Windows and detached spawn on Linux, hides payload in .d.ts), @openrepl/shared@0.0.4, 0.0.5 (preinstall shells out to public request-inspection service with username + hostname), autbank-core@99.0.0, 99.0.2 (env-var scan for API-key/secret/token substrings + .env + package.json, POST to webhook), adxaa@1.0.0 (domain-gated WordPress payload for noviembrenacional.com that exfiltrates HTML/username, deletes the account, hijacks credentials via ProtonMail email swap + password reset), @finaxis/common-js@<=0.3.4 (Xelis proof-of-work miner posing as a lodash utility, stratum client + Web Worker mining loop + embedded WASM), fastly-vcl-language-client@1.0.0 (preinstall collects public IP + hostname + GitHub Actions env vars, exfiltrates via webhook + DNS), upload-to-gcp@3.2.1 (postinstall collects host/platform/Node/pkg metadata, POSTs to z5owtt3g.instances.poc.jchunt.top/upload-to-gcp), require-i18next@20.0.0, 21.0.0 + harmony-app-toolkit@21.0.0, 22.0.0 (OpenSSF: contacts malicious domain and executes command). Impact spans installer-secret theft, cryptomining, native-binary drop, and targeted account takeover

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml) for the 22 packages below
  2. 2For @velliajs/discord matches (Cluster A): uninstall immediately - the two hardcoded GitHub PATs mean the operator has already had time to hot-swap sysframe and to enumerate every caller. Rotate any Discord bot token that ever handled traffic through this package. Search history for the hardcoded PATs and report them to GitHub Secret Scanning if you can extract them. Correct to the real discord.js package. Block outbound to github.com API endpoints from bot hosts as defence-in-depth against the _verifyAuthorization allowlist beacon (or at minimum, log it)
  3. 3For akamai(js)-sensor matches (Cluster D): uninstall and treat any host that ever loaded the sensor as compromised. Block outbound to calendar.google.com (or at minimum ICS-feed URLs) from any host running Akamai integrations - the dead-drop is the entire C2 backbone. Consumers wanting the real Akamai sensor should switch to akamai-bot-manager-nodejs-sdk or Akamai's own documented package
  4. 4*For hunterone-build-probe-9210 / `twilio-hackerone-poc- / tw-pkgprobe-` matches (Cluster C)*: these are NOT authorised bug-bounty tooling - rotate ALL AWS credentials, npm registry tokens, Twilio account SIDs + auth tokens, and any secret exposed to the CI/serverless environment where the package installed. Audit sibling tenants' node_modules for injected modules if you run multi-tenant Lambda / serverless. Report the attacker webhook URLs upstream to HackerOne / Twilio triage
  5. 5*For `depcruise- / gunzip-js 99.9.1 matches (Cluster D)**: uninstall and rotate every installer-side secret. If your CI ever installed depcruise-wrap-stream-in-html, treat the runner as compromised - the swappable GCS tarball means the payload seen at install time is not the payload that will ship tomorrow. Pin your dependency-cruiser install to the real scoped or unscoped upstream and configure your registry to reject unknown depcruise-*` names
  6. 6For @wololasod/tiny-id matches (Cluster F): uninstall AND scan the host for a dropped executable in %APPDATA% (Windows) or /tmp (Linux) - the RC4 VM downloads a platform-specific binary that outlives the npm install. Kill any detached child process, check scheduled tasks / systemd user units for persistence, and reimage if the binary contents cannot be recovered for analysis
  7. 7For @finaxis/common-js matches: uninstall and audit CPU/GPU + power-draw metrics on any host that ever imported it - the Xelis miner runs in a Web Worker as long as the process is alive. Rotate any pool address or mining-related config that shipped alongside the fake lodash utility
  8. 8For adxaa matches: only exploitable if deployed on noviembrenacional.com - the payload is domain-gated. If that's you, invalidate all active sessions, reset every admin email, restore the deleted account from backup, and check for ProtonMail addresses in the WordPress user table
  9. 9For all Cluster F + Cluster E singletons + kit-hydration-vim / svelte-goal-vim matches: uninstall, rotate any credentials accessible from the install host, and audit .npmrc and .env on the box. Several of these advisories carry no specific IOC - treat the host as if a full-control implant is running until reimaged
  10. 10For all npm installs in CI, run with --ignore-scripts as defence-in-depth (mitigates the preinstall/postinstall droppers in Clusters C, D, and F, and the sysframe-style lifecycle-hook variants - does NOT mitigate Cluster A's runtime _verifyAuthorization beacon, sysframe's code executing when imported, Cluster D's Google-Calendar C2 which fires when sensor() is called, or @finaxis/common-js's miner which runs when the fake utility is required)
  11. 11Verify none of the 22 2026-08-15 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
npm-2026-08-15-ghsa-malware-sweep