Compromised package, severity critical

Malicious code in vas-tops2-core-client-cleanup-ui

Published October 30, 2026, updated October 31, 2026

Malicious code in vas-tops2-core-client-cleanup-ui (npm). Source: MAL-2026-18420 (GHSA-8j2v-vwh4-x2hm).

What's affected

• vas-tops2-core-client-cleanup-ui (npm)>=0

What to do

1. Remove vas-tops2-core-client-cleanup-ui from manifests and lockfiles, and block the affected versions.
2. Run /pharon:check-incident on every machine and CI runner that installed it, then rotate the credentials available there.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident mal-2026-18420

References

• https://osv.dev/vulnerability/MAL-2026-18420
• https://github.com/advisories/GHSA-8j2v-vwh4-x2hm

Notice mal-2026-18420, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.