Shai-Hulud / ChainDrop — self-propagating npm worm across 665 package versions

On 2026-08-04 (~10:38 UTC) a self-propagating npm supply-chain worm — tracked publicly as Shai-Hulud / ChainDrop — republished malicious versions of hundreds of packages across ~40 npm scopes. Initial entry was a hijacked maintainer GitHub account; propagation was automatic via stolen npm publish tokens and GitHub PATs harvested on each install.

The malicious versions add a preinstall script that invokes node setup.mjs. setup.mjs silently downloads the legitimate Bun runtime, then executes an obfuscated ~728 KB infostealer payload (math_init.js or Math_Symbol.js) which harvests npm tokens, GitHub PATs (classic + fine-grained), OAuth secrets, OIDC JWTs, AWS credentials, Kubernetes service-account tokens, HashiCorp Vault secrets, Stripe keys, and Slack tokens. Persistence is planted into .claude/settings.json and .vscode/tasks.json so the payload re-executes on next IDE / AI-coding-agent session.

Every ingested infected version in the codelake corpus fired pkgbehavior.static.dynamic-exec on the dropper file and pkgbehavior.static.child-spawn-dynamic on setup.mjs. Cross-check against the Wiz Research IOC list yielded 665 verified matches on 439 unique package names — 100% precision on the ingested subset, 99% name coverage of the reference list.

Top affected npm scopes by verified-infected-version count in the codelake corpus:

• @servicetitan — 171 versions
• @onereach — 155 versions
• @or-sdk — 148 versions
• @ornikar — 84 versions
• @qlik — 28 versions
• @nebula.js — 21 versions
• @umacloud — 8 versions
• @arv-bedrock — 5 versions
• @cacheable — 4 versions
• @picsart — 2 versions
• @hubsync — 2 versions
• @deliveroo — 2 versions

@adminide-stack/clock-tik-browser@12.0.24, @adminide-stack/yantra-mobile@12.0.33, @arv-bedrock/auth@1.1.8, @arv-bedrock/auth-admin@1.0.3, @arv-bedrock/auth-sso@1.6.2, @arv-bedrock/auth-sso-backend@1.7.2, @arv-bedrock/logger@1.7.2, @cacheable/memory@2.2.1, @cacheable/net@2.1.1, @cacheable/node-cache@3.1.2, @cacheable/utils@2.5.1, @deliveroo/determinator@0.2.1, @deliveroo/reevent@1.0.1, @hubsync/web-sdk-react@6.3.32, @hubsync/web-sdk-react@6.3.33, @nebula.js/cli@7.1.2, @nebula.js/cli-build@7.1.2, @nebula.js/cli-sense@7.1.2, @nebula.js/locale@0.6.2, @nebula.js/nucleus@0.5.1, @nebula.js/sn-action-button@2.3.1, @nebula.js/sn-animator@2.13.1, @nebula.js/sn-distributionplot@1.0.7, @nebula.js/sn-layout-container@4.4.1, @nebula.js/sn-line-chart@2.7.1, @nebula.js/sn-listbox@0.19.3, @nebula.js/sn-map@0.12.7, @nebula.js/sn-nav-menu@0.14.2, @nebula.js/sn-org-chart@1.7.1, @nebula.js/sn-shape@1.5.1, @nebula.js/sn-slider@0.20.1, @nebula.js/sn-tabbed-container@2.4.1, @nebula.js/snapshooter@0.6.1, @nebula.js/stardust@7.1.2, @nebula.js/test-utils@0.6.1, @nebula.js/theme@0.6.1, @onereach/authorizer-helper@0.0.12, @onereach/authorizer-helper@0.0.13, @onereach/bandwidth-steps-voice-bxml@0.1.2, @onereach/bandwidth-steps-voice-bxml@0.1.3, @onereach/billing-dto@27.2.2, @onereach/billing-dto@27.2.3, @onereach/billing-shared@27.2.2, @onereach/billing-shared@27.2.3, @onereach/cb-schema-translator@1.3.2, @onereach/cb-schema-translator@1.3.3, @onereach/channel-transformer@0.0.67, @onereach/channel-transformer@0.0.68, @onereach/channel-transformers@0.0.6, @onereach/channel-transformers@0.0.7, @onereach/ckeditor5-build-classic@30.0.2, @onereach/ckeditor5-build-classic@30.0.3, @onereach/condition-builder@1.0.10, @onereach/condition-builder@1.0.9, @onereach/content-builder@0.0.19, @onereach/content-builder@0.0.20, @onereach/content-builder-template-compiler@0.0.4, @onereach/content-builder-template-compiler@0.0.5, @onereach/expression-components@9.1.2, @onereach/expression-components@9.1.3, @onereach/font-icons@27.0.3, @onereach/font-icons@27.0.4, @onereach/get-version-data@3.1.3, @onereach/get-version-data@3.1.4, @onereach/idw-apps@0.1.4, @onereach/idw-apps@0.1.5, @onereach/idw-contracts@0.1.3, @onereach/idw-contracts@0.1.4, @onereach/idw-init-account-resources@1.0.2, @onereach/idw-init-account-resources@1.0.3, @onereach/idw-sdk@0.1.3, @onereach/idw-sdk@0.1.4, @onereach/idw-ui-components@0.1.3, @onereach/idw-ui-components@0.1.4, @onereach/lambda-invocation@1.2.2, @onereach/lambda-invocation@1.2.3, @onereach/messengers-infobip-sdk@0.1.2, @onereach/messengers-infobip-sdk@0.1.3, @onereach/or-browser@0.0.49, @onereach/or-browser@0.0.50, @onereach/or-browser-next@0.0.12, @onereach/or-browser-next@0.0.13, @onereach/or-content-builder-renderer@0.0.3, @onereach/or-content-builder-renderer@0.0.4, @onereach/or-file-uploader-next@0.0.10, @onereach/or-file-uploader-next@0.0.9, @onereach/or-pro@1.13.2, @onereach/or-pro@1.13.3, @onereach/or-sdk-agent-cli@0.0.7, @onereach/or-sdk-agent-cli@0.0.8, @onereach/orest-cli@2.4.2, @onereach/orest-cli@2.4.3, @onereach/orest-input-cli@1.18.2, @onereach/orest-input-cli@1.18.3, @onereach/orest-jest-presets@0.0.4, @onereach/orest-jest-presets@0.0.5, @onereach/orest-vue-demi-vue2@0.0.5, @onereach/orest-vue-demi-vue2@0.0.6, @onereach/orest-vue-demi-vue3@0.0.5, @onereach/orest-vue-demi-vue3@0.0.6, @onereach/orest-vue3@0.0.5, @onereach/orest-vue3@0.0.6, @onereach/phonenumber-interpreter@0.0.19, @onereach/phonenumber-interpreter@0.0.20, @onereach/pnpm-audit-junit@1.0.4, @onereach/pnpm-audit-junit@1.0.5, @onereach/postcss-scoped-selector@1.2.2, @onereach/postcss-scoped-selector@1.2.3, @onereach/regex-helper@0.5.17, @onereach/regex-helper@0.5.18, @onereach/regular-expressions@0.5.24, @onereach/regular-expressions@0.5.25, @onereach/regular-expressions-test@0.0.5, @onereach/regular-expressions-test@0.0.6, @onereach/rwc-client@6.4.8, @onereach/rwc-client@6.4.9, @onereach/salesforce-miaw-client@0.0.4, @onereach/salesforce-miaw-client@0.0.5, @onereach/si-a-button@0.0.4, @onereach/si-a-button@0.0.5, @onereach/si-alert@0.4.12, @onereach/si-alert@0.4.13, @onereach/si-checkbox@0.6.6, @onereach/si-checkbox@0.6.7, @onereach/si-checkbox-group@0.3.6, @onereach/si-checkbox-group@0.3.7, @onereach/si-code@0.6.5, @onereach/si-code@0.6.6, @onereach/si-collapsible-group@0.6.5, @onereach/si-collapsible-group@0.6.6, @onereach/si-copyable-text@0.4.12, @onereach/si-copyable-text@0.4.13, @onereach/si-datepicker@0.4.6, @onereach/si-datepicker@0.4.7, @onereach/si-divider@0.4.12, @onereach/si-divider@0.4.13, @onereach/si-dropdown-advanced@0.4.6, @onereach/si-dropdown-advanced@0.4.7, @onereach/si-dropdown-simple@0.4.6, @onereach/si-dropdown-simple@0.4.7, @onereach/si-header@0.4.14, @onereach/si-list@0.7.5, @onereach/si-list@0.7.6, @onereach/si-merge-tag-input@0.4.6, @onereach/si-merge-tag-input@0.4.7, @onereach/si-radio-group@0.3.6, @onereach/si-radio-group@0.3.7, @onereach/si-root@0.9.5, @onereach/si-root@0.9.6, @onereach/si-select@0.1.4, @onereach/si-select@0.1.5, @onereach/si-step-chooser@0.4.5, @onereach/si-step-chooser@0.4.6, @onereach/si-switch@0.4.6, @onereach/si-switch@0.4.7, @onereach/si-text-message@0.4.6, @onereach/si-text-message@0.4.7, @onereach/si-textinput@0.5.6, @onereach/si-textinput@0.5.7, @onereach/si-validated-timestring-input@0.3.6, @onereach/si-validated-timestring-input@0.3.7, @onereach/slack-helpers@1.0.4, @onereach/slack-helpers@1.0.5, @onereach/ssml-editor@2.0.13, @onereach/ssml-editor@2.0.14, @onereach/step-components@0.1.38, @onereach/step-components@0.1.39, @onereach/step-conversation@1.0.42, @onereach/step-conversation@1.0.43, @onereach/step-run-snowflake-query@0.1.2, @onereach/step-run-snowflake-query@0.1.3, @onereach/step-voice@7.0.33, @onereach/step-voice@7.0.34, @onereach/styles@27.0.3, @onereach/styles@27.0.4, @onereach/time-interpreter@1.0.31, @onereach/time-interpreter@1.0.32, @onereach/ts-memoize@1.0.3, @onereach/ts-memoize@1.0.4, @onereach/types-contacts-api@9.0.10, @onereach/types-contacts-api@9.0.9, @onereach/ui-components@27.0.3, @onereach/ui-components@27.0.4, @onereach/ui-components-common@27.0.3, @onereach/ui-components-common@27.0.4, @onereach/ui-components-vue2@27.0.3, @onereach/ui-components-vue2@27.0.4, @onereach/v-event-calendar@0.1.23, @onereach/v-event-calendar@0.1.24, @onereach/webform@0.3.14, @onereach/webform@0.3.15, @or-sdk/account-settings@1.3.7, @or-sdk/account-settings@1.3.8, @or-sdk/accounts@2.3.6, @or-sdk/accounts@2.3.7, @or-sdk/adapters@0.3.7, @or-sdk/adapters@0.3.8, @or-sdk/agents@4.21.4, @or-sdk/agents@4.21.5, @or-sdk/api-tokens@1.4.3, @or-sdk/api-tokens@1.4.4, @or-sdk/api-tokens-lambda@1.4.3, @or-sdk/api-tokens-lambda@1.4.4, @or-sdk/apps@1.2.7, @or-sdk/apps@1.2.8, @or-sdk/auth@0.38.2, @or-sdk/auth@0.38.3, @or-sdk/authorizer@0.26.8, @or-sdk/authorizer@0.26.9, @or-sdk/base@0.44.5, @or-sdk/base@0.44.6, @or-sdk/billing@27.2.2, @or-sdk/billing@27.2.3, @or-sdk/billing-internal@27.2.2, @or-sdk/billing-internal@27.2.3, @or-sdk/bot-templates@2.2.6, @or-sdk/bot-templates@2.2.7, @or-sdk/bots@1.7.2, @or-sdk/bots@1.7.3, @or-sdk/card-templates@2.2.6, @or-sdk/card-templates@2.2.7, @or-sdk/cards@1.2.6, @or-sdk/cards@1.2.7, @or-sdk/ccp@10.15.5, @or-sdk/ccp@10.15.6, @or-sdk/chat@0.3.2, @or-sdk/chat@0.3.3, @or-sdk/contacts@4.7.6, @or-sdk/contacts@4.7.7, @or-sdk/content-request@0.2.7, @or-sdk/content-request@0.2.8, @or-sdk/data-hub@0.26.6, @or-sdk/data-hub@0.26.7, @or-sdk/data-hub-svc@2.3.6, @or-sdk/data-hub-svc@2.3.7, @or-sdk/deployer@1.7.6, @or-sdk/deployer@1.7.7, @or-sdk/deployments@2.1.6, @or-sdk/deployments@2.1.7, @or-sdk/discovery@1.12.2, @or-sdk/discovery@1.12.3, @or-sdk/druid@1.4.8, @or-sdk/druid@1.4.9, @or-sdk/event-manager@1.1.6, @or-sdk/event-manager@1.1.7, @or-sdk/files@3.11.7, @or-sdk/files@3.11.8, @or-sdk/files-sync-node@0.1.10, @or-sdk/files-sync-node@0.1.9, @or-sdk/flow-templates@2.1.6, @or-sdk/flow-templates@2.1.7, @or-sdk/flows@2.7.10, @or-sdk/flows@2.7.9, @or-sdk/graph@1.10.6, @or-sdk/graph@1.10.7, @or-sdk/hitl@0.41.2, @or-sdk/hitl@0.41.3, @or-sdk/identifiers@0.27.7, @or-sdk/identifiers@0.27.8, @or-sdk/idw@9.0.5, @or-sdk/idw@9.0.6, @or-sdk/idw-public@1.6.7, @or-sdk/idw-public@1.6.8, @or-sdk/idw-skill@1.4.2, @or-sdk/idw-skill@1.4.3, @or-sdk/invitations@1.4.10, @or-sdk/invitations@1.4.9, @or-sdk/key-value-storage@0.28.7, @or-sdk/key-value-storage@0.28.8, @or-sdk/keys@1.2.7, @or-sdk/keys@1.2.8, @or-sdk/knowledge-models@0.25.6, @or-sdk/knowledge-models@0.25.7, @or-sdk/library@0.5.7, @or-sdk/library@0.5.8, @or-sdk/library-categories@0.2.7, @or-sdk/library-categories@0.2.8, @or-sdk/library-source@0.4.6, @or-sdk/library-source@0.4.7, @or-sdk/library-types-v1@9.0.2, @or-sdk/library-types-v1@9.0.3, @or-sdk/library-types-v2@9.0.2, @or-sdk/library-types-v2@9.0.3, @or-sdk/lookup@1.25.2, @or-sdk/lookup@1.25.3, @or-sdk/markdowner@0.5.2, @or-sdk/markdowner@0.5.3, @or-sdk/mcp-tools@0.5.3, @or-sdk/mcp-tools@0.5.4, @or-sdk/notifications@1.7.6, @or-sdk/notifications@1.7.7, @or-sdk/password@1.3.7, @or-sdk/password@1.3.8, @or-sdk/payments@3.2.6, @or-sdk/payments@3.2.7, @or-sdk/permissions@2.8.2, @or-sdk/permissions@2.8.3, @or-sdk/permissions-cli@1.4.2, @or-sdk/permissions-cli@1.4.3, @or-sdk/permissions-lambda@2.5.2, @or-sdk/permissions-lambda@2.5.3, @or-sdk/pgsql@1.5.2, @or-sdk/pgsql@1.5.3, @or-sdk/providers@0.3.7, @or-sdk/providers@0.3.8, @or-sdk/qna@3.4.3, @or-sdk/qna@3.4.4, @or-sdk/queue-manager@1.4.7, @or-sdk/queue-manager@1.4.8, @or-sdk/sdk-api@0.29.3, @or-sdk/sdk-api@0.29.4, @or-sdk/settings@0.25.7, @or-sdk/settings@0.25.8, @or-sdk/sku-builder@2.5.2, @or-sdk/sku-builder@2.5.3, @or-sdk/source@2.1.6, @or-sdk/source@2.1.7, @or-sdk/source-api@1.1.2, @or-sdk/source-api@1.1.3, @or-sdk/step-templates@2.2.6, @or-sdk/step-templates@2.2.7, @or-sdk/store@2.1.6, @or-sdk/store@2.1.7, @or-sdk/tables@0.28.6, @or-sdk/tables@0.28.7, @or-sdk/tags@1.1.6, @or-sdk/tags@1.1.7, @or-sdk/tickets@1.9.6, @or-sdk/tickets@1.9.7, @or-sdk/transcripts@1.2.6, @or-sdk/transcripts@1.2.7, @or-sdk/users@3.8.2, @or-sdk/users@3.8.3, @or-sdk/view-templates@2.2.6, @or-sdk/view-templates@2.2.7, @or-sdk/views@3.1.6, @or-sdk/views@3.1.7, @or-sdk/web-search@0.6.2, @or-sdk/web-search@0.6.3, @ornikar/apollo-link-timeout@1.4.11, @ornikar/apollo-link-timeout@1.4.7, @ornikar/babel-preset-base@6.0.10, @ornikar/babel-preset-base@6.0.14, @ornikar/babel-preset-kitt-universal@8.0.12, @ornikar/babel-preset-kitt-universal@8.0.8, @ornikar/babel-preset-react@6.1.10, @ornikar/babel-preset-react@6.1.14, @ornikar/browserslist-config@8.0.11, @ornikar/browserslist-config@8.0.9, @ornikar/commitlint-config@8.3.12, @ornikar/commitlint-config@8.3.8, @ornikar/eslint-config@24.0.12, @ornikar/eslint-config@24.0.8, @ornikar/eslint-config-babel@24.0.12, @ornikar/eslint-config-babel@24.0.8, @ornikar/eslint-config-babel-use@13.2.12, @ornikar/eslint-config-babel-use@13.2.8, @ornikar/eslint-config-formatjs@24.0.10, @ornikar/eslint-config-formatjs@24.0.6, @ornikar/eslint-config-node@12.2.10, @ornikar/eslint-config-node@12.2.6, @ornikar/eslint-config-react@24.0.11, @ornikar/eslint-config-react@24.0.7, @ornikar/eslint-config-typescript@24.0.10, @ornikar/eslint-config-typescript@24.0.6, @ornikar/eslint-config-typescript-nestjs@24.0.11, @ornikar/eslint-config-typescript-nestjs@24.0.7, @ornikar/eslint-config-typescript-react@24.0.11, @ornikar/eslint-config-typescript-react@24.0.7, @ornikar/eslint-plugin-neverthrow@1.3.12, @ornikar/eslint-plugin-neverthrow@1.3.8, @ornikar/eslint-plugin-ornikar@24.0.11, @ornikar/eslint-plugin-ornikar@24.0.7, @ornikar/graphql-config@1.1.11, @ornikar/graphql-config@1.1.7, @ornikar/intl-config@10.0.10, @ornikar/intl-config@10.0.8, @ornikar/jest-config@13.0.13, @ornikar/jest-config@13.0.9, @ornikar/jest-config-react@18.0.11, @ornikar/jest-config-react@18.0.8, @ornikar/jest-config-react-native@17.0.12, @ornikar/jest-config-react-native@17.0.8, @ornikar/jest-config-react-native-web@12.0.13, @ornikar/jest-config-react-native-web@12.0.9, @ornikar/kitt2@1.0.11, @ornikar/kitt2@1.0.7, @ornikar/lerna-config@11.0.11, @ornikar/lerna-config@11.0.7, @ornikar/monorepo-config@14.3.13, @ornikar/monorepo-config@14.3.9, @ornikar/postcss-config@9.1.12, @ornikar/postcss-config@9.1.8, @ornikar/prettier-config@9.0.11, @ornikar/prettier-config@9.0.9, @ornikar/prismic-components@0.0.12, @ornikar/prismic-components@0.0.8, @ornikar/react-modern-calendar-datepicker@3.2.11, @ornikar/react-modern-calendar-datepicker@3.2.7, @ornikar/react-native-svg-transformer@1.0.11, @ornikar/react-native-svg-transformer@1.0.13, @ornikar/renovate-config@9.0.13, @ornikar/renovate-config@9.0.9, @ornikar/repo-config@15.3.13, @ornikar/repo-config@15.3.9, @ornikar/repo-config-react@13.0.15, @ornikar/repo-config-react@13.0.19, @ornikar/repo-config-react-legacy-css@15.1.13, @ornikar/repo-config-react-legacy-css@15.1.9, @ornikar/rollup-config@11.1.13, @ornikar/rollup-config@11.1.9, @ornikar/rollup-plugin-postcss@2.0.11, @ornikar/rollup-plugin-postcss@2.0.15, @ornikar/slate-react-fork@1.0.11, @ornikar/slate-react-fork@1.0.7, @ornikar/storybook-config@12.1.10, @ornikar/storybook-config@12.1.7, @ornikar/stylelint-config@14.0.13, @ornikar/stylelint-config@14.0.9, @ornikar/typed-css-modules-loader@0.8.12, @ornikar/typed-css-modules-loader@0.8.8, @ornikar/webpack-config@12.0.12, @ornikar/webpack-config@12.0.8, @picsart/ai-sdk@3.32.2, @picsart/gen-ai@2.55.11, @qlik/api@2.14.2, @qlik/browserslist-config@3.0.2, @qlik/carbon-core@2.1.1, @qlik/carboncopy@1.1.6, @qlik/design-tokens@1.3.13, @qlik/dts-bundler@2.0.3, @qlik/embed-react@2.5.3, @qlik/embed-runtime@1.6.4, @qlik/embed-svelte@1.1.4, @qlik/embed-web-components@1.7.3, @qlik/eslint-config@2.0.20, @qlik/eslint-config-base@0.1.1, @qlik/eslint-config-react@0.1.1, @qlik/eslint-config-svelte@0.1.1, @qlik/eslint-config-vue@0.1.1, @qlik/nebula-table-utils@2.6.9, @qlik/oxfmt-config@0.1.6, @qlik/oxlint-config@0.7.2, @qlik/prettier-config@1.0.3, @qlik/react-native-simple-grid@1.5.5, @qlik/runtime-module-loader@1.5.1, @qlik/sdk@0.28.1, @qlik/sprout-design-docs@1.0.2, @qlik/sprout-gesture@0.0.13, @qlik/sprout-icons@0.12.3, @qlik/sprout-react@6.45.3, @qlik/sprout-react-table@0.16.7, @qlik/tsconfig@1.0.3, @servicetitan/acquisition-functions@5.22.7, @servicetitan/admin-layout@2.4.9, @servicetitan/admin-sql-table@1.0.20, @servicetitan/ajax-handlers@38.1.7, @servicetitan/anvil-css-utilities@14.5.10, @servicetitan/anvil-css-utilities@14.5.9, @servicetitan/anvil-fonts@14.5.10, @servicetitan/anvil-fonts@14.5.8, @servicetitan/anvil-icon@0.5.7, @servicetitan/anvil-icons@14.5.10, @servicetitan/anvil-icons@14.5.9, @servicetitan/anvil-react@0.11.9, @servicetitan/anvil-themes@14.5.10, @servicetitan/anvil-token@0.4.7, @servicetitan/anvil2@3.9.6, @servicetitan/anvil2@3.9.7, @servicetitan/anvil2-codemods@0.11.8, @servicetitan/anvil2-ext-atlas@4.0.7, @servicetitan/anvil2-ext-atlas@4.0.8, @servicetitan/anvil2-ext-charts@0.2.10, @servicetitan/anvil2-ext-common@0.7.7, @servicetitan/anvil2-ext-mwv@0.0.11, @servicetitan/anvil2-illustrations@1.0.8, @servicetitan/anvil2-mcp@0.0.15, @servicetitan/assist-ui@2.1.7, @servicetitan/assist-utils@1.1.8, @servicetitan/carto-charts-core@0.0.8, @servicetitan/carto-charts-react@0.0.8, @servicetitan/carto-charts-rn@0.0.7, @servicetitan/carto-charts-rn@0.0.8, @servicetitan/carto-react-kit@0.8.10, @servicetitan/carto-rn-kit@0.0.16, @servicetitan/carto-tokens@0.3.7, @servicetitan/component-usage@28.5.7, @servicetitan/confirm@41.3.7, @servicetitan/confirm-navigation@41.3.7, @servicetitan/contentful@0.0.9, @servicetitan/contentful-proxy@1.1.17, @servicetitan/contentful-proxy@1.1.18, @servicetitan/cp-api@1.115.7, @servicetitan/cp-mfe@1.115.7, @servicetitan/cp-mfe-dev@1.115.7, @servicetitan/cp-react-hooks@1.115.7, @servicetitan/cp-ui@1.115.7, @servicetitan/culture@41.3.7, @servicetitan/data-query@41.3.7, @servicetitan/datadog-rum@38.1.6, @servicetitan/datadog-rum@38.1.7, @servicetitan/datetime-utils@41.3.7, @servicetitan/design-system@14.5.10, @servicetitan/design-system@14.5.9, @servicetitan/docs-anvil-uikit-contrib@41.3.7, @servicetitan/docs-uikit@38.1.7, @servicetitan/document-title@2.4.7, @servicetitan/dte-pdf-editor@1.76.7, @servicetitan/dte-unlayer@0.150.6, @servicetitan/dte-unlayer@0.150.7, @servicetitan/eh-module-communication@0.2.7, @servicetitan/error-boundary@38.1.6, @servicetitan/error-boundary@38.1.7, @servicetitan/eslint-config@38.1.6, @servicetitan/eslint-config@38.1.7, @servicetitan/eslint-plugin@38.1.6, @servicetitan/eslint-plugin@38.1.7, @servicetitan/eslint-plugin-decorators-declare@12.8.21, @servicetitan/eslint-plugin-folder-schema@38.1.7, @servicetitan/eslint-plugin-mobx-6@12.8.20, @servicetitan/eslint-plugin-processors-stub@12.8.21, @servicetitan/examples@1.2.11, @servicetitan/feature-spotlight@3.9.7, @servicetitan/folder-lint@38.1.6, @servicetitan/folder-lint@38.1.7, @servicetitan/forge@0.5.6, @servicetitan/forge@0.5.7, @servicetitan/form@41.3.6, @servicetitan/form@41.3.7, @servicetitan/form-state@41.3.6, @servicetitan/form-state@41.3.7, @servicetitan/grid@0.0.69, @servicetitan/hammer-icon@1.2.7, @servicetitan/hammer-react@1.42.8, @servicetitan/hammer-token@3.1.7, @servicetitan/hash-browser-router@38.1.7, @servicetitan/help-center@1.0.14, @servicetitan/html-sketchapp@4.2.14, @servicetitan/install@38.1.5, @servicetitan/install@38.1.7, @servicetitan/intl@7.2.7, @servicetitan/json-render-react@0.4.12, @servicetitan/kendo-theme@0.0.33, @servicetitan/ko-bridge@38.1.7, @servicetitan/launchdarkly-service@38.1.7, @servicetitan/lazy-module@38.1.7, @servicetitan/ld-type-generator@0.2.7, @servicetitan/line-item-editor@1.5.6, @servicetitan/line-item-editor@1.5.7, @servicetitan/link-item@41.3.7, @servicetitan/log-service@38.1.5, @servicetitan/log-service@38.1.7, @servicetitan/marketing-direct-mail-components@20.1.7, @servicetitan/marketing-email-components@20.2.9, @servicetitan/marketing-form@0.1.8, @servicetitan/marketing-global-route@1.14.7, @servicetitan/marketing-integration-widgets@1.0.46, @servicetitan/marketing-route@1.2.7, @servicetitan/marketing-ui@9.3.7, @servicetitan/marketing-widgets@1.0.6, @servicetitan/marketing-widgets@1.0.7, @servicetitan/measure-sheet-data@2.6.7, @servicetitan/mfe-quick-actions@0.5.55, @servicetitan/micro-frontend@0.0.10, @servicetitan/micro-frontend@0.0.9, @servicetitan/microfront@0.0.8, @servicetitan/microfront-auth@0.0.11, @servicetitan/microfront-tests@0.0.17, @servicetitan/microfront-utils@1.4.7, @servicetitan/modularpayments-webfields@1.0.59, @servicetitan/moneyout-api-client@1.29.7, @servicetitan/mpa-components@2.5.7, @servicetitan/navigation@14.1.7, @servicetitan/notifications@41.3.7, @servicetitan/onboarding-ui@18.5.6, @servicetitan/onboarding-ui@18.5.7, @servicetitan/quick-actions@1.15.8, @servicetitan/react-hooks@7.7.7, @servicetitan/react-ioc@38.1.7, @servicetitan/responsive@6.1.7, @servicetitan/restrict-imports@38.1.7, @servicetitan/schema-comparison@0.1.9, @servicetitan/skeleton@9.2.10, @servicetitan/standalone-core-feature-gates@1.11.10, @servicetitan/standalone-feature-flags@2.3.8, @servicetitan/standalone-root@1.11.8, @servicetitan/standalone-root@1.11.9, @servicetitan/standalone-tm-api@1.1.6, @servicetitan/standalone-tm-api@1.1.7, @servicetitan/standalone-ui@2.2.10, @servicetitan/startup@38.1.7, @servicetitan/startup-jest@2.2.7, @servicetitan/startup-mfe-compat@0.5.7, @servicetitan/startup-utils@38.1.7, @servicetitan/stylelint-config@38.1.6, @servicetitan/stylelint-config@38.1.7, @servicetitan/table@41.3.7, @servicetitan/tanstack-query-mobx@6.2.7, @servicetitan/temporal-lite@3.4.7, @servicetitan/testing-library@6.6.5, @servicetitan/testing-library@6.6.7, @servicetitan/thoughtspot-theme@1.7.7, @servicetitan/time-zones@3.8.7, @servicetitan/titan-chat-ui@7.1.9, @servicetitan/titan-chat-ui-anvil2@9.0.7, @servicetitan/titan-chat-ui-common@9.0.6, @servicetitan/titan-chat-ui-common@9.0.7, @servicetitan/titan-chat-ui-cypress@2.1.9, @servicetitan/titan-chatbot-api@9.0.7, @servicetitan/titan-chatbot-client@2.1.9, @servicetitan/titan-chatbot-ui@7.1.9, @servicetitan/titan-chatbot-ui-anvil2@9.0.7, @servicetitan/titan-chatbot-ui-cypress@9.0.7, @servicetitan/tokens@12.9.6, @servicetitan/tokens@12.9.7, @servicetitan/toolbelt-shared-registry@1.14.6, @servicetitan/toolbelt-shared-registry@1.14.7, @servicetitan/uikit-docs@22.11.7, @servicetitan/unit-tests@0.0.8, @servicetitan/va-mfe-loader@1.1.7, @servicetitan/web-components@38.1.5, @servicetitan/web-components@38.1.7, @servicetitan/widget-platform@5.6.7, @servicetitan/widget-platform-monolith@5.6.7, @thiennq/docs-viewer@1.6.2, @thiennq/docs-viewer@1.6.4, @umacloud/cli-darwin-arm64@1.0.74, @umacloud/cli-darwin-x64@1.0.74, @umacloud/cli-linux-arm64@1.0.74, @umacloud/cli-linux-musl-arm64@1.0.74, @umacloud/cli-linux-musl-x64@1.0.74, @umacloud/cli-linux-x64@1.0.74, @umacloud/cli-win32-x64@1.0.74, @umacloud/knowledge@1.0.74, @workbench-stack/core@3.9.8, babel-plugin-linaria-css-to-undefined@0.3.17, cacheable@2.5.1, conv-context-next@1.0.10, ecto@5.0.1, editable-contracts@0.0.27, eslint-plugin-folder-schema@1.0.21, example-js-project@1.0.11, file-entry-cache@11.1.6, folder-lint@1.0.21, frontend-orb@4.4.18, hamus.js@0.4.1, http-metrics-middleware@2.2.2, keyv@6.0.0, native-frontend-orb@1.1.19, picasso-plugin-hammer@2.11.6, picasso-plugin-q@2.11.6, picasso.js@2.11.6, pob-test-package-in-monorepo@5.2.16, pob-test-typescript-package-in-monorepo@4.2.17, qlik-chart-modules@1.1.1, qlik-modifiers@0.10.1, qlik-object-conversion@0.17.2, rwc-client@0.29.19, server-hemera-mongo@0.0.12, sn-listbox@0.3.3, tslint-folder-schema@1.0.21, umadev@1.0.74, verdaccio-okta-oauth@38.1.16, verdaccio-tarball-local-storage@38.1.16, workbench-browser-server@0.0.2

Primary detection + IOC list published by Wiz Research. codelake Research contribution: independent cross-verification, precision measurement, and additional coverage-gap analysis against a 1.7M-package continuous npm scan corpus.