Skip to content

2026-02-06 — NPM malware packages: @rsgweb/*, @sporting-life/*, @meli-lint/*, @hashicorp-internal/vault-reporting, and others

Sources: - https://github.com/advisories/GHSA-gw69-p5jg-cx4f (@sporting-life/sportinglife-be) - https://github.com/advisories/GHSA-h4pp-8q2m-94jf (@sporting-life/sportinglife-betslip-sdk) - https://github.com/advisories/GHSA-rqwj-m2m4-crj4 (@rsgweb/modules-core-www-page) - https://github.com/advisories/GHSA-78qc-m7fr-qq7g (@rsgweb/tina) - https://github.com/advisories/GHSA-2q2j-g79q-g7h3 (@rsgweb/utils) - https://github.com/advisories/GHSA-93fm-3r2f-cf76 (@rsgweb/modules-core-feedback) - https://github.com/advisories/GHSA-m9hg-mwfh-rcp3 (@rsgweb/rockstar-account) - https://github.com/advisories/GHSA-45p4-h5vh-f9rw (@rsgweb/locale-tools) - https://github.com/advisories/GHSA-m67c-8w34-xpjg (@sbseg-plugin/qbo-web-app-ui) - https://github.com/advisories/GHSA-m52r-4c3v-2f62 (@rdxportal/ui-components) - https://github.com/advisories/GHSA-48f8-cj2c-h5ph (@opposhop/nuxt-ssr-cache) - https://github.com/advisories/GHSA-3hr9-qjx2-7xvf (@meli-lint/eslint-config-base) - https://github.com/advisories/GHSA-hc82-h5cp-3cmr (@meli-lint/eslint-config-base-ts) - https://github.com/advisories/GHSA-jjwg-57v8-4486 (@meli-lint/eslint-config-tests-jest) - https://github.com/advisories/GHSA-hcfh-22r5-mc4r (@hashicorp-internal/vault-reporting) - https://github.com/advisories/GHSA-24w6-mgww-45jc (web3-sinon) - https://github.com/advisories/GHSA-jq52-9634-mx8p (web3-chain-sinon) - https://github.com/advisories/GHSA-vw8w-h7g2-48g9 (aligned-arrays)

Published: 2026-02-06
Type: Malware / supply-chain compromise

What happened

GitHub published malware advisories for multiple NPM packages (all advisories carry the same high-severity warning: any machine that installed or ran these packages should be considered fully compromised).

Packages flagged:

  • @sporting-life/sportinglife-be — GHSA-gw69-p5jg-cx4f

  • @sporting-life/sportinglife-betslip-sdk — GHSA-h4pp-8q2m-94jf

  • @rsgweb/modules-core-www-page — GHSA-rqwj-m2m4-crj4

  • @rsgweb/tina — GHSA-78qc-m7fr-qq7g
  • @rsgweb/utils — GHSA-2q2j-g79q-g7h3
  • @rsgweb/modules-core-feedback — GHSA-93fm-3r2f-cf76
  • @rsgweb/rockstar-account — GHSA-m9hg-mwfh-rcp3

  • @rsgweb/locale-tools — GHSA-45p4-h5vh-f9rw

  • @sbseg-plugin/qbo-web-app-ui — GHSA-m67c-8w34-xpjg

  • @rdxportal/ui-components — GHSA-m52r-4c3v-2f62

  • @opposhop/nuxt-ssr-cache — GHSA-48f8-cj2c-h5ph

  • @meli-lint/eslint-config-base — GHSA-3hr9-qjx2-7xvf

  • @meli-lint/eslint-config-base-ts — GHSA-hc82-h5cp-3cmr

  • @meli-lint/eslint-config-tests-jest — GHSA-jjwg-57v8-4486

  • @hashicorp-internal/vault-reporting — GHSA-hcfh-22r5-mc4r

  • web3-sinon — GHSA-24w6-mgww-45jc

  • web3-chain-sinon — GHSA-jq52-9634-mx8p
  • aligned-arrays — GHSA-vw8w-h7g2-48g9

Why this matters (durable guidance)

For supply-chain malware, the durable guidance is operational: - Treat installs as potential code execution (install scripts, postinstall hooks, bundled binaries). - The correct response is incident response (containment + credential rotation + rebuild), not just uninstall. - CI runners and developer machines are both common execution points.

What to do now (triage)

If you suspect any of these packages were installed or executed:

  1. Isolate the host

  2. Disconnect or block outbound access.

  3. Rotate secrets from a clean machine

  4. Rotate anything that was reachable from the host: cloud/API keys, CI secrets, SSH keys, browser sessions, package tokens (npm), etc.

  5. Rebuild rather than “clean”

  6. Prefer re-imaging / ephemeral rebuilds of dev machines and CI runners.

  7. Scope exposure

  8. Identify where the host authenticated (GitHub orgs, cloud accounts, registries).

  9. Review auth logs and unusual outbound connections around install/execute time.

  10. Harden dependency intake

  11. Lockfiles, dependency review gates, allowlists/private registries, and SBOM/provenance checks where available.

References

  • Related checklist: /checklists/malicious-package-response.md
  • Related best practice: /best-practices/supply-chain-malware-triage.md