VV-159criticalSupply chain2026-10-22

Malicious npm packages posing as AI agent tools: agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude

Between October 20 and 22, GitHub flagged three npm packages with AI-agent names as malware: agentic-awesome-skills (20 versions), x402-prompt-injection-scan 0.1.4 and formatting-subtitles-for-claude (every version). If any of them was installed, treat that computer as compromised.

01.

What it is

GHSA-rgwm-3jj9-h563 (2026-10-22) covers 20 versions of agentic-awesome-skills between 18.9.0 and 19.13.0, a name that imitates collections of agent skills for coding assistants.

GHSA-w84w-rhx7-2f7g (2026-10-22) covers x402-prompt-injection-scan 0.1.4, which poses as a prompt-injection scanner. GHSA-xxr7-33gg-pcg6 (2026-10-20) covers every version of formatting-subtitles-for-claude.

GitHub's guidance for each one: any computer that has the package installed or running should be considered fully compromised, and removing it may not remove everything it installed.

02.

How to check

Search lockfiles, global npm installs and agent skill folders for agentic-awesome-skills, x402-prompt-injection-scan and formatting-subtitles-for-claude.
Be careful with agent skill and helper packages suggested by an AI assistant or a random repo; check the publisher and download history first.

03.

How to fix

If you find one, remove it, treat the machine as compromised, and rotate all secrets and keys it could reach from a different computer.
Use npm ci with a committed lockfile, and consider an allowlist or install-time scanner for new dependencies.

npm ls -g --depth=0 2>/dev/null | grep -E 'agentic-awesome-skills|x402-prompt-injection-scan|formatting-subtitles-for-claude'; grep -rnE 'agentic-awesome-skills|x402-prompt-injection-scan|formatting-subtitles-for-claude' package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

04.

Sources

More advisories for this tool