Malicious packages target the Syft SBOM tool namespace: syft-acp-atoms, syft-acp-core, syft-acp-uikit

Three npm packages published on July 16, 2026 target the namespace of Syft, Anchore's open source SBOM generator. syft-acp-atoms, syft-acp-core, and syft-acp-uikit all carry malicious code and return risk_state: critical in Attestd's supply chain layer. No press coverage of this cluster has been found as of publication. No attribution has been established.

Syft is one of the most widely used SBOM generation tools in the ecosystem. It scans container images, directory trees, and archives across dozens of package ecosystems and produces SPDX and CycloneDX output. It sees broad adoption in enterprise CI/CD pipelines, often in security-sensitive build contexts where it runs alongside vulnerability scanners and provenance tools. The official GitHub Action anchore/sbom-action wraps it directly. Targeting its namespace is targeting the tooling that security teams use to understand what is in their own software.

The version pattern#

All three malicious packages are published at version 0.0.1-0, a pre-release semver specifier. The clean versions of the same packages return safe at 1.0.0. The 0.0.1-0 pre-release version is consistent with namespace squatting, publishing to claim a name before a legitimate project reaches it, or with dependency confusion attacks targeting environments that resolve pre-release versions explicitly.

What Attestd returns#

curl "https://api.attestd.io/v1/check?product=syft-acp-atoms&version=0.0.1-0" \
  -H "Authorization: Bearer $ATTESTD_API_KEY"

{
  "product": "syft-acp-atoms",
  "version": "0.0.1-0",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": ["supply_chain_compromised"],
  "confidence": 0.95,
  "cve_ids": [],
  "supply_chain": {
    "compromised": true,
    "sources": ["osv"],
    "malware_type": "malware",
    "description": "Malicious code in syft-acp-atoms (npm)",
    "compromised_at": "2026-07-16T00:00:00Z",
    "removed_at": null
  },
  "supply_chain_monitored": true
}

The same shape holds for syft-acp-core and syft-acp-uikit. No CVEs. risk_state: critical from the supply chain signal alone.

The clean versions:

All three clean versions return risk_state: none with supply_chain.compromised: false.

The broader cluster#

The research pipeline that surfaced these packages also identified two additional packages under the @edgecommons scope: @edgecommons/edgecommons and @edgecommons/streamlog-node. Both are flagged compromised with the same July 16 timestamp. The @edgecommons scope does not correspond to a widely identified public project, making it a less conclusive target identification than the syft-acp packages. All five packages appear to have been published in the same window.

What is not known#

The OSV advisories for these packages describe generic malicious code without payload specifics. The technique used, what the malware collects or exfiltrates, and whether this is namespace squatting or an active dependency confusion attack against an organisation using these names internally are not confirmed from the available data. The post reflects what the supply chain monitoring layer can verify: malicious code is present, the packages are published, and they remain in the registry with removed_at: null.

Attribution is unestablished. No actor or campaign has been named in connection with this cluster.

Coverage#

syft-acp-atoms, syft-acp-core, and syft-acp-uikit are covered and return risk_state: critical with supply_chain.compromised: true for version 0.0.1-0. Clean versions at 1.0.0 return risk_state: none. Responses above are live from the production API as of July 20, 2026.

If any of these packages appear in a dependency tree or lockfile, remove them. There is no patch version: the safe path is removing the dependency entirely.

API documentation: attestd.io/docs. Detection ledger: github.com/attestd-io/detection-ledger. Machine speed thesis: attestd.io/thesis.