evil-pkg@1.0.0 · scan

CRITverdict·evil-pkg@1.0.0just now

17 services exposed · 5 lockfiles resolved the bad version · 6 typosquats nearby.
fix:  pnpm update evil-pkg@^1.0.0   ▸  breach window 4h 12m

fix command

$ pnpm update evil-pkg@^1.0.0

https://meridian.sithunyein.com/scan/evil-pkg%401.0.0

▸ open replay

The six tiles

1ms · hydradb:https://cheap-dawn-noble-located.trycloudflare.com (fixture tiles)

CRIT

17 services exposed

17 rows · 45ms

MATCH (npm:evil-pkg@1.0.0)<-[:DEPENDS_ON*1..6]-(svc:Service)

service	team	env	hops
checkout-svc	platform	prod	1
worker-queue	checkout	stage	2
edge-router	growth	prod	3
auth-api-gw	billing	prod	4
billing-svc	edge	prod	1
pricing-svc	platform	prod	2
search-svc	checkout	stage	3
notification-svc	growth	prod	4
audit-logger	billing	prod	1
tenant-router	edge	prod	2
ci-runner-api	platform	prod	3
feature-flags-svc	checkout	stage	4
dlq-pull	growth	prod	1
geo-redirector	billing	prod	2
session-store	edge	prod	3
metrics-collector	platform	prod	4
incident-room-bot	checkout	stage	1

HIGH

first bad version: 3.10.8

3 rows · 49ms

MATCH (advisory)-[:AFFECTS]->(version) — published timeline

version	published	repo	live_during_compromise
3.10.7	2026-07-12	github.com/TanStack/virtual	false
3.10.8	2026-08-14	github.com/TanStack/virtual	true
3.10.9	2026-08-15	github.com/TanStack/virtual	false

HIGH

5 lockfiles resolved this version

5 rows · 59ms

MATCH (Version)<-[:RESOLVES]-(Lockfile)<-[:USES_LOCKFILE]-(Service)

lockfile	service	team	captured	window
apps/web/package-lock.json	checkout-svc	platform	2026-08-11T00:00Z	4h 12m
services/checkout/package-lock.json	worker-queue	checkout	2026-08-12T01:00Z	4h 12m
services/worker/package-lock.json	edge-router	growth	2026-08-13T02:00Z	4h 12m
packages/ui-tw/package-lock.json	auth-api-gw	billing	2026-08-14T03:00Z	4h 12m
packages/util/package-lock.json	billing-svc	edge	2026-08-15T04:00Z	4h 12m

INFO

4 packages share a maintainer

4 rows · 45ms

MATCH (Maintainer)-[:MAINTAINS]->(sibling) — same-CI clusters collapse

package	ecosystem	monthly_downloads	same_ci
evil-pkg-util	npm	240000	true
evil-pkg-cli	pypi	223000	false
evil-cli	npm	206000	false
@evil/pkg	pypi	189000	false

HIGH

6 typosquat candidates within edit-distance 2

6 rows · 53ms

MATCH (Package)<-[:TYPOSQUAT_OF { distance: 1..2 }]-(candidate)

candidate	edit_distance	first_seen	installs
evil-pkgx	1	2026-08-10T00:00Z	1280
evilpack	2	2026-08-11T01:00Z	1170
evilpkg	1	2026-08-12T02:00Z	1060
evil-pkg-old	2	2026-08-13T03:00Z	950
@evil-pkg	1	2026-08-14T04:00Z	840
evi1-pkg	2	2026-08-15T05:00Z	730

CRIT

blast radius: 17 services · 5 lockfiles · 6 typosquats

1 rows · 42ms

AGG services ⊕ lockfiles ⊕ typosquats — 3 optional MATCH arms in one query

services_count	lockfiles_count	typosquats_count
17	5	6

00:00PUBLISHevil-pkg

evil-pkg@1.0.0 published clean

60:00INSTALL

+dependency.added chalk-extra 0.0.1

120:00PUBLISHevil-pkg

evil-pkg@1.0.0 rebuilt with payload

180:00ALERT

typosquat install spike 240× chalk-extras

240:00INSTALL

co-maintainer vit-dev-bot 12 ops/min

300:00LOCKFILE

5 lockfiles × 17 services resolved the bad version

360:00GUARD

breach window 4h 12m push guard ⚑

evil-pkg exposure.