# DependencyWatch.io incident feed > Every supply-chain compromise tracked by DependencyWatch.io, newest first: 217 incidents across 10 ecosystems, 5,378 compromised packages. Each entry links to a full write-up with affected packages and exact versions, impact, remediation, and sourced references. Last updated 2026-10-13. Append `.md` to any incident URL for the markdown version, or use the JSON API at https://dependencywatch.io/api/v1/incidents. ## Incident kinds Every entry is one of: - **Compromise**: A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on. - **Typosquat**: A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK. - **Dependency confusion**: A package published on the public registry under a name guessed from a company's private registry, usually at a sentinel version such as 0.0.0 or 99.99.0, so a misconfigured resolver pulls it instead of the internal one. Many are bug-bounty or penetration-test probes whose only payload is a beacon with the hostname. - **Malicious package**: A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name. - **Advisory sweep**: A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole. ## 2026-10 - [GitHub Advisory malware sweep - 2026-10-13 (**Baileys/libsignal lure operator wave 3** - 60+ npm packages across `@revizahoshii/*`, `@fazzcodestudio/*`, `@sanzoffc/*`, `@wanzlonely/*`, `@mikudeveloper/*`, `@modss/*`, `@ikanngeming/*`, `@fhkryxv/*`, `@saazkira/*`, `@badzz88/*`, `@alipclutch/*`, `@mivesensei/*`, `@kanaraa/*`, `@chatunity/*`, `@zanta/*`, `@yudzxml/*`, `@zeronexcode/*`, plus `baileys-xbats`/`bailslonely`/`nakkinpm`/`amprem` unscoped - all CWE-506 boilerplate takedowns against `@WhiskeySockets/Baileys` WhatsApp-automation lures; **confirmed-payload carve-outs within the sweep**: PyPI `npp-ml` Notepad++ impersonator deploying ADExplorer AD-recon tool, PyPI `minecraftaccfinder` Gmail/Roblox/Discord/Minecraft infostealer+RAT with keylogger/screenshots/browser-creds, RubyGems `wallet-balance-scanner` fake-native-extension reverse-shell to hardcoded endpoint; **s4yhii wave 3 continuation** `@s4yhiitestpoc/r2-https-b` on `collector.oob.s4yhii.com`; plus 25+ dep-confusion probes at `99.x`/`100.x`/`101.x` sentinels: `@myorder-frontend-commons/*`, `risk-detection`, `unified-platform`, `@pinecone-experience/*`, `@airbnb-extended/*`, `@tesla-insurance/*`, `@user-services/*`, `app-sca-info-banking`, `com.apple.unityplugin.storekit` Apple-brand impersonator, and more)](https://dependencywatch.io/incident/multi-2026-10-13-ghsa-malware-sweep.md) - 2026-10-13 · high · advisory sweep · npm, PyPI, RubyGems · 87 packages. GHSA 2026-10-12 batch (ingested 2026-10-13): ~90 fresh malware advisories, dominated by a **Baileys/libsignal lure operator wave 3** of 60+ WhatsApp-automation-brand typosquats (continuation of 2026-10-10 Cluster C). Confirmed payloads: PyPI [`npp-ml`](https://github.com/advisories/GHSA-hmg9-h2ww-x4x3) Notepad++ impersonator deploying `ADExplorer`, PyPI [`minecraftaccfinder`](https://github.com/advisories/GHSA-gw9m-gc3w-389x) multi-platform infostealer+RAT, RubyGems [`wallet-balance-scanner`](https://github.com/advisories/GHSA-g92c-g6pm-wf38) fake-native-extension reverse shell. Plus `@s4yhiitestpoc/r2-https-b` continuing s4yhii wave 3 and 25+ dep-confusion sentinel probes. - [GitHub Advisory malware sweep - 2026-10-12 (**s4yhii operator wave 3**: 8 npm packages across `@s4yhiitestpoc/*` + `@coopeuch/*` Coopeuch-brand dep-confusion all beaconing `collector.oob.s4yhii.com/_npm-poc/beacon`; **`185.158.107.175:8787/_ah/dc` operator wave 2**: 6 npm `beacon.cjs`-pattern recon packages (`nitro-cjs-requirer`, `nitro-bundled-dep`, `nested-lib`, `cloudflare_module`, `another-very-long-name`, `some-very-long-package-name`); **`64.181.165.115/dc` native-addon operator**: 4 npm packages with HTTP/1.0 raw-socket beacons (`ksp-app`, `ksp-client-registry`, `pay-methods-kmf`, `deposit-limit-fe`); `liferay-workspace-scripts` bundled-dep from `ltidi.storage.googleapis.com/depenconf/`; `react-dropzone-v4`/`react-paginate-v5`/`kmf-vendor-pack`/`exodus-firestore-synchronize` dep-confusion probes; `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer; `css-nesting-transform@1.0.0` Wix-brand `webhook.site` recon; PyPI `ig-gox` (`goxtools.shop` encrypted-loader) + `py2ops` trojaned-REPL. Big RubyGems wgkit wave-2 crypto cluster split out to its own carve-out.)](https://dependencywatch.io/incident/multi-2026-10-12-ghsa-malware-sweep.md) - 2026-10-12 · high · advisory sweep · npm, PyPI · 27 packages. GHSA 2026-10-11 batch (ingested 2026-10-12): 25+ fresh malware advisories across npm + PyPI, dominated by **s4yhii operator wave 3** (`collector.oob.s4yhii.com/_npm-poc/beacon` across `@s4yhiitestpoc/*` + `@coopeuch/*`) and a second `185.158.107.175:8787/_ah/dc` dep-confusion family. Also `hardhat-option@2.0.1` npm `hardhat-promised`-family stealer, PyPI `ig-gox` `goxtools.shop` encrypted-loader, and `py2ops` trojaned Python-2 REPL. The 24 RubyGems wgkit wave-2 crypto gems were split into their [own carve-out](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster). - [RubyGems wgkit wave 2 - 24 DeFi/MEV/wallet/NFT crypto gems at `0.9.1` drop a direct `/bin/sh` reverse shell to `45.138.12.177:8089` from `extconf.rb`, same operator as the 2026-10-05 wgkit cluster](https://dependencywatch.io/incident/rubygems-2026-10-12-wgkit-wave-2-crypto-defi-cluster.md) - 2026-10-12 · high · malicious package · RubyGems · 24 packages. OpenSSF/Amazon Inspector flagged **24 fresh malicious RubyGems** on 2026-10-11 (ingested 2026-10-12) - all v`0.9.1`, all shipping an `ext//extconf.rb` base64-decoded Ruby payload that double-forks, sleeps 20-40 min, and pipes a TCP socket to `/bin/sh` against `45.138.12.177:8089`. Same C2 IP, same evasion gates, same `bitcoin_rpc_lite_native` cover extension as the 2026-10-05 wgkit cluster - **this is wave 2 of the same operator**, now targeting DeFi/MEV/wallet-HD/NFT/TRC20/jetton verticals. - [npm `hridoy-ultimate@8.0.0` ships Facebook email + password + TOTP 2FA secrets to `minhdong.site/api/v1/facebook/login_ios` and pins its `fca-unofficial` dep at `VangBanLaNhat/fca-unofficial#HEAD`](https://dependencywatch.io/incident/npm-2026-10-12-hridoy-ultimate-fb-credential-stealer.md) - 2026-10-12 · high · malicious package · npm · 1 package. `hridoy-ultimate@8.0.0` on npm advertises as an "unofficial Facebook chat client", but `module/loginHelper.js` posts the caller-supplied FB email, password, AND TOTP 2FA secret to `minhdong.site/api/v1/facebook/login_ios`, and the package pins its `fca-unofficial` dependency to a bare `VangBanLaNhat/fca-unofficial` GitHub repo (no SHA, no tag) so the attacker can swap install-time code at will. GHSA-8chm-j6jp-f4h3 / MAL-2026-17803, published 2026-10-11. - [GitHub Advisory malware sweep - 2026-10-11 (new `webreader` + `pafer` PyPI two-package pickle-execution RAT with disclosed `frjmzbjbhwvtdnsuodmu.supabase.co` + `api.npoint.io/40e32d283a9d97e59252/a` C2 and `.pth` persistence, where the main package hides the pickle and the mandatory dependency unpickles it; new `agentaix` PyPI 3-package first-publish RAT cluster (`agentaix`, `agent-vx`, `media-manager5`) with autorun persistence beaconing `googleforum.pythonanywhere.com`; and standalone `@library-wide/library-shell@99.9.1` npm dep-confusion sentinel flagged by OpenSSF Package Analysis for malicious-domain egress)](https://dependencywatch.io/incident/multi-2026-10-11-ghsa-malware-sweep.md) - 2026-10-11 · high · advisory sweep · npm, PyPI · 6 packages. GHSA 2026-10-11: 6 fresh malware advisories (1 npm, 5 pypi) in 3 clusters. Headline: **new `webreader`+`pafer` PyPI pickle-execution RAT** - lure ships a pickle "config", its mandatory `pafer` dep unpickles it (RCE), drops a `.pth` autoloader, pulls stage 2 from a Supabase bucket via `api.npoint.io`. Plus a 3-package `agentaix` RAT cluster beaconing `googleforum.pythonanywhere.com`. - [GitHub Advisory malware sweep - 2026-10-10 (new `s4yhii` native-binary credential-stealer dep-confusion operator - 16 npm packages across `@galicia-toolkit-nestjs/*`, `@galicia-toolkit-nestjs-20/*`, `@galicia-toolkit-nestjs-20-lite/*`, `@galicia-toolkit-cheques-nc/*`, `@brick-v2/*` loading prebuilds/-/metrics.node ELF+PE that forks+setsid and exfils AWS/GitHub/npm/Azure DevOps/Actions tokens to oob.s4yhii.com/native; `@tunstock/remact-dom@19.2.0` react-dom typosquat with confirmed `tele.metry.orgin.net/api/v1/events` beacon; Baileys/libsignal lure continuation `@fer2809fl/baileys`+`cloud-baileys`+`arsya-baileys`+10-package `asepxyz*` cluster; crates.io `sharpnes` Telegram-Desktop + Chrome-extension/wallet infostealer (first cargo malware advisory this week); 3-package `kmf-*` + 2-package internal-frontend dep-confusion with oast.pro OAST; 5-package `@tvg-mar/*` dep-confusion probes; 2 Tailwind typosquats; plus pypi `ig-gox` Instagram abuse)](https://dependencywatch.io/incident/multi-2026-10-10-ghsa-malware-sweep.md) - 2026-10-10 · high · advisory sweep · crates.io, npm, PyPI · 47 packages. GHSA 2026-10-10: ~48 fresh malware advisories across 10 clusters (46 npm, 1 pypi, 1 crates). Headline items: **new `s4yhii` operator native-binary credential-stealer dep-confusion cluster** (16 packages across `@galicia-toolkit-nestjs*` and `@brick-v2` scopes, prebuilds/metrics.node ELF+PE forks+setsid and exfils cloud/CI tokens to `oob.s4yhii.com/native`); first-seen **crates.io infostealer `sharpnes`** targeting Telegram Desktop sessions + Chrome extension/wallet data via Telegram Bot API; and **`@tunstock/remact-dom@19.2.0` react-dom typosquat** with confirmed install-time beacon to `tele.metry.orgin.net`. - [GitHub Advisory malware sweep - 2026-10-09 (xwise8887 wave-2 continuation `wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` to `185.158.107.175:8787/_ah/dc`; Wix dep-confusion cluster `wix-reg-poc-bypass` (webhook.site) + `css-overscroll-contain` (dxpoc.gt.tc, K8s SA-token theft + container escape); `pxnpm` nfjbill-operator npm proxy weaponization (same operator as 2026-08 `yakuza0`); 16-package `@bellaxchuu/*` + sibling Baileys-themed lure cluster; 6-package `@dransay/*` oast.site dep-confusion probes; `@bitwardne/*` 2-package Bitwarden typosquat; 5-package `@galicia-toolkit/*`+`@design-system-coopeuch/web` dep-confusion cluster; 9 dev-tooling typosquats; 2 pypi `kafka-roller`/`kafka-helmsman` 99.x dep-confusion probes; plus standalones)](https://dependencywatch.io/incident/multi-2026-10-09-ghsa-malware-sweep.md) - 2026-10-09 · high · advisory sweep · npm, PyPI · 50 packages. GHSA 2026-10-09: 50 fresh malware advisories across 10 clusters (48 npm, 2 pypi). Headline items: **continuation of the `xwise8887` dep-confusion operator** (`wie888r`/`testrrrd`/`xblaxw`/`@wxwxtest/testrrrdd` beaconing to the same `185.158.107.175:8787/_ah/dc` endpoint as yesterday); **Wix dep-confusion cluster** including `css-overscroll-contain` which carries K8s service-account token theft and container-escape payload; and **`pxnpm` npm proxy weaponization** from the same operator (`nfjbill.ren`) as the 2026-08 `yakuza0@2.23.40` malicious release. - [`tensorlake` npm maintainer-account compromise - malicious `0.5.144` published one patch above the real `0.5.143` latest and quarantined by npm security](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise.md) - 2026-10-08 · critical · compromise · npm · 1 package. On 2026-10-08 a malicious `tensorlake@0.5.144` was published to npm, exactly one patch above the real TensorLake AI `0.5.143` latest. The upstream package is the official TensorLake AI document-ingestion / sandbox CLI/SDK with 100 legitimate releases across four maintainers; `0.5.144` was removed from the registry and GHSA-rqxj-g25x-4v9v flagged the version as malware. Pattern is a maintainer-account or publish-credential compromise. - [GitHub Advisory malware sweep - 2026-10-08 (named compromise carve-out: `tensorlake@0.5.144` maintainer-account compromise; plus npm `internallib_v788` wave-3 continuation of the `internallib_v` RFC1918 reverse-shell operator; new npm `troubleshooting`/`browser-metrics-plugin.contrib` dep-confusion probe from `xwise8887` with HTTP beacon to `185.158.107.175:8787`; new npm `personio-pipeline-projen` dep-confusion probe from `reaperhackbot256f` with `oast.fun`+`oastify.com` DNS/HTTPS exfil; new npm `imgbundle`+`cdn-img-fetch` img-themed sleeper cluster from `malfexteste2`; npm `function-color@1.7.3`+`function-flag@1.7.3` 2025-08-04 backfilled low-version sideload sleepers caught today; 3-package npm `@ikyyjee/ikkysingle`/`ikyysingle`/`ikyysinggle` typosquat burst; 2 Amazon-Inspector namespace-holder takedowns `windows_registry_editor`/`store-webpack-config`; and 5 CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-10-08-ghsa-malware-sweep.md) - 2026-10-08 · high · advisory sweep · npm · 19 packages. GHSA 2026-10-08: 20 fresh malware advisories across 9 clusters (19 npm, 1 pypi carried forward from end-of-day yesterday). The dominant story is the **tensorlake maintainer-account compromise** (`tensorlake@0.5.144` published one patch above the real `0.5.143` latest of the official TensorLake AI SDK - [carved out as its own named incident](https://dependencywatch.io/incident/npm-2026-10-08-tensorlake-maintainer-compromise)). Also: wave-3 of the `internallib_v` RFC1918 reverse-shell operator (`internallib_v788`); two new dep-confusion probes with confirmed network beacons; a 2-package img-themed sleeper cluster; two 2025-08-04 sideload sleepers (`function-color`/`function-flag@1.7.3`) caught today; and a 3-package `@ikyyjee` typosquat burst. - [GitHub Advisory malware sweep - 2026-10-07 (wave-2 continuation of 2026-10-05 operators: npm `hardhat-init` pino-impersonator jsonspack sibling of yesterday`s `hardhat-roof`/`hardhat-plus`, npm `css-jptvix-polyfill` Wix dep-confusion recon + NEW `appsecc.com/js` reverse-shell second stage, npm `@pinecone-experience/messages@99.9.1` Pinecone-impersonator tarball-URL install-RCE from `ltidi` GCS bucket, 4-package npm `internallib_v23/30/86/875` RFC1918 `10.0.19.80` reverse-shell cluster, pypi `lore-cs` HackerOne-bugbounty dep-confusion probe, plus 2 CWE-506 boilerplate takedowns `@kxa/xbails` and `captchetat-angularv8`)](https://dependencywatch.io/incident/multi-2026-10-07-ghsa-malware-sweep.md) - 2026-10-07 · high · advisory sweep · npm, PyPI · 10 packages. GHSA 2026-10-07: 10 fresh malware advisories across 6 clusters (1 pypi, 9 npm). Dominated by wave-2 continuations of yesterday`s operator families - the `jsonspack.com` pino-impersonator (`hardhat-init`), the Wix dep-confusion operator now with an `appsecc.com/js` reverse-shell second stage (`css-jptvix-polyfill`), a new 4-package `internallib_v` reverse-shell cluster at `10.0.19.80` RFC1918, and a Pinecone-impersonator tarball-URL install-RCE (`@pinecone-experience/messages@99.9.1`). - [GitHub Advisory malware sweep - 2026-10-06 (3 fresh advisories: pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe, npm `virgil-cli` runtime conversation/shell-output exfil to api.nm-streetwear.space, npm `dotenv-async` CWE-506 boilerplate takedown; plus 2026-10-05 backfill: 2 npm `@inpeek/odata*` dep-confusion probes at 99.99.99-102 sentinel versions, pypi `erc7730-hackathon@99.0.0` OpenSSF-flagged PROBABLY_PENTEST probe; 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 SPLIT OUT)](https://dependencywatch.io/incident/multi-2026-10-06-ghsa-malware-sweep.md) - 2026-10-06 · high · advisory sweep · npm, PyPI · 6 packages. GHSA 2026-10-06: 3 fresh malware advisories (`zencleaner` pypi, `virgil-cli` + `dotenv-async` npm) plus 3 same-week backfill (`@inpeek/odata*` npm dep-confusion probes, `erc7730-hackathon` pypi pentest probe) across 5 clusters. The 25-gem [RubyGems Ethereum/crypto wgkit cluster](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) from 2026-10-05 is SPLIT OUT. - [GitHub Advisory malware sweep - 2026-10-05 (10 npm `hellscripter`/gitflic.ru typosquats of @angular/@babel/express/nuxt via preinstall `curl | node`; 26 npm Wix dep-confusion recon probes - CSS polyfill/a11y/tiny-*/rgx33-* names; 4 npm pino-impersonator jsonspack obfuscator trojans - hardhat-*/chai-as-testmode; 5 npm `4444.vbs` ChaCha20 PowerShell loader siblings - lite-matte/studiocode; plus `@kibt/www-nuxt-i18n` dep-confusion, `internallib_v275` reverse-shell, `monitoring-agent` express credential middleware, `promises-dotenv3` steganographic VBS dropper, `oleh-modal` wallet-connect phishing, `ultimate-websocket` tarball-URL RCE, `core-js-gnz` Python-payload postinstall; `anthropic-sdk` pypi typosquat SPLIT OUT)](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep.md) - 2026-10-05 · high · advisory sweep · npm · 52 packages. GHSA 2026-10-05: 52 new npm advisories across 11 clusters. Cluster A - 10 `hellscripter` gitflic.ru typosquats of @angular/@babel/express/nuxt. Cluster B - 26 Wix dep-confusion recon probes. Cluster C - 4 pino-impersonator jsonspack obfuscator trojans. Cluster D - 5 `4444.vbs` ChaCha20 PowerShell loader siblings. Clusters E-K - 7 standalone operator one-offs. The pypi `anthropic-sdk` typosquat is SPLIT OUT as its own named incident. - [pip `anthropic-sdk` typosquat of Anthropic`s official `anthropic` SDK - credentials, env vars, AI chat files, SSH keys exfiltrated over HTTPS and DNS (OpenSSF campaign `2026-10-anthropic-sdk`, GHSA-xxp4-7566-29xj)](https://dependencywatch.io/incident/pypi-2026-10-05-anthropic-sdk-typosquat.md) - 2026-10-05 · high · typosquat · PyPI · 1 package. A single-version PyPI package `anthropic-sdk@0.1.0` (GHSA-xxp4-7566-29xj) typosquats the official Anthropic Python SDK (real name: `anthropic`). On install it fingerprints the sandbox, downloads a remote stage, and exfiltrates credentials, env vars, **AI chat files**, and SSH keys over HTTPS and DNS. Classify `typosquat` + `high`. - [RubyGems Ethereum/crypto wgkit cluster - 25 gems drop `/tmp/.w1/wg_install.sh` from 45.138.*.*](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster.md) - 2026-10-05 · high · malicious package · RubyGems · 25 packages. OpenSSF/Amazon Inspector flagged 25 RubyGems packages posing as Ethereum/Bitcoin/Lightning crypto utilities on 2026-10-05. All v`1.0.0`; `extconf.rb` base64/XOR-decodes a Ruby payload, double-forks, sleeps 20-40 min, then downloads `wgkit.tar.gz` from `45.138.*.*:8089-8092` and runs `/tmp/.w1/wg_install.sh`. Fires only on dev hosts with SSH/git/gem creds. - [GitHub Advisory malware sweep - 2026-10-03 (late) + 2026-10-04 (10 pip `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of the `2026-10-voxeval` cryptominer campaign - continuation of yesterday`s `voxeval` NEW campaign entry, same OpenSSF campaign slug, CWE-506 "imitates real activity and instead deploys a coin miner"; 1 pip `echogen` generic install-time info-exfil pentest probe with no corpus siblings)](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep.md) - 2026-10-04 · high · advisory sweep · PyPI · 11 packages. GHSA 2026-10-03 (late): 11 new pip advisories. Cluster A - 10 `voxcpm*`/`voxel-tts`/`caoxiltts`/`infrabench` siblings of yesterday`s `2026-10-voxeval` cryptominer campaign (yesterday`s `voxeval` was sibling 1 of 12). Cluster B - 1 generic install-time info-exfil pentest probe `echogen`. No new npm, Go, or RubyGems advisories in this 24h window. - [GitHub Advisory malware sweep - 2026-10-02 (late) + 2026-10-03 (npm `amel10` AWS API Gateway dep-confusion mass push targeting Amazon/Alexa internal names - 6 confirmed packages sharing C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com`: `alexa-cybertron-team-code-review-agent`, `okra-cloud-cdk`, `ai-workshop-radio-app`, `ai-workshop-maa15-radio`, `ai-workshop-radio-lambda`, `niksinnkatalapp`; 5 npm PhantomSub Baileys silent WhatsApp follow siblings `mikuhostt-baileys`, `luoxy-baileys`, `@zanta/baileys`, `wailib`, `prastzy`; pip `dedh-devops-automation` AWS Lambda + Secrets Manager credential theft `spo365-graph` family continuation; pip `voxeval` cryptominer NEW campaign `2026-10-voxeval`; 2 Go module `Graphalgo` campaign expansion `gogets.dev/btreex`, `gocommunity.io/orderedbtree`; npm `@bluewin/utils` Burp-Collaborator Swisscom-scope dep-confusion probe by `securityresearch1`; npm `@smwebserver/static@99.9.1` sentinel-version malicious-domain beacon; 9 npm CWE-506 boilerplate takedowns `turbo-ws`, `hardhat-zet`, `ui-base-colors`, `translate-base-font`, `ui.dist.min.js`, `@woodpecker-web-shared/components`, `bnppf-flag-icons`)](https://dependencywatch.io/incident/multi-2026-10-03-ghsa-malware-sweep.md) - 2026-10-03 · high · advisory sweep · Go, npm, PyPI · 24 packages. GHSA 2026-10-02 (late) + 2026-10-03: ~26 new advisories. Confirmed payloads: 6-package `amel10` npm dep-confusion mass push against Amazon/Alexa internal names (shared C2 `s85r5k14qk.execute-api.us-east-1.amazonaws.com`); 5 PhantomSub Baileys siblings (query ID `7871414976211147`); pip `dedh-devops-automation` AWS Lambda credential theft (`spo365-graph` family day 2); pip `voxeval` cryptominer; 2 Go modules in the `Graphalgo` campaign. - [GitHub Advisory malware sweep - 2026-10-01 (late) + 2026-10-02 (npm Baileys silent WhatsApp follow mass batch, 15 siblings sharing query ID `7871414976211147`: `@xayz/baileys`, `xvinleys`, `yonzoffic-baileys`, `xzbails`, `xzvexpzcbailey`, `yonzofficial`, `kiyoramarkets`, `kasabaileys`, `my-baileys`, `lilys-baileys`, `noxleyss`, `syncxbails`, `whalibmob`, `ishumdz-bail`, `eliteprotech-baileys`; pip `spo365-graph` NEW campaign - AWS Lambda deploy + AWS Secrets Manager credential theft; pip `friendly-tools` Snowflake credential-theft `friendly-greeting-tools` family continuation; pip `shortneer` Chrome-extension crypto-wallet + Telegram infostealer (`sherpy` campaign continuation); npm `future-scripts` browser DoS `boom()` time-bomb detonating 2026-10-10; npm `online-header@99.0.0` sentinel-version malicious-domain beacon; 5 npm CWE-506 boilerplate takedowns `illusion-datalab`, `homestack-cheer`, `kartykgithub-ph-f`, `kartykgithub-ph-e`, `kartykgithub-ph-b`)](https://dependencywatch.io/incident/multi-2026-10-02-ghsa-malware-sweep.md) - 2026-10-02 · high · advisory sweep · npm, PyPI · 25 packages. GHSA 2026-10-01 (late) + 2026-10-02: 26 new advisories (23 npm + 3 pip). Confirmed payloads: 15 npm Baileys silent-WhatsApp-follow siblings (`jexkcode`/`noverojs` family); pip `spo365-graph` AWS Lambda + Secrets Manager credential theft (new); pip `friendly-tools` Snowflake exfil; pip `shortneer` Chrome-wallet stealer; npm `future-scripts` browser DoS time-bomb set for 2026-10-10. - [GitHub Advisory malware sweep - 2026-09-30 (late) + 2026-10-01 (pip `beautifytext` import-time RAT; pip `friendly-greeting-tools` Snowflake credential theft to attacker-controlled S3; npm `noverojs` Baileys silent WhatsApp follow family continuation; npm `com.epi.e2e_test` dep-confusion reconnaissance beacon to `meta.brs.cx`; 7 npm Epic Games Store scope dep-confusion probes (`set-egs-backend`, `qa-egs-rollback`, `generator-epic-react`, `player-support-tools-ui`, `mod-manager`, `ssp-config-management-tool`, `store-service-worker`); 6 npm `mms-*` scope dep-confusion probes; 8 npm CWE-506 boilerplate bug-bounty researcher probes)](https://dependencywatch.io/incident/multi-2026-10-01-ghsa-malware-sweep.md) - 2026-10-01 · high · advisory sweep · npm, PyPI · 25 packages. GHSA 2026-09-30 (late) + 2026-10-01: 26 new advisories (24 npm + 2 pip). Confirmed payloads: pip `beautifytext` import-time RAT; pip `friendly-greeting-tools` Snowflake credential theft to `s3://pkusinski-external/`; npm `noverojs` Baileys silent-WhatsApp-follow family continuation. Remainder are dep-confusion scope probes (Epic Games Store, `mms-*`) and CWE-506 boilerplate. ## 2026-09 - [GitHub Advisory malware sweep - 2026-09-29 (late) + 2026-09-30 (npm `tailwind-forms-kit` EtherHiding on Ethereum mainnet with wallet `0xa322E5...63e1a`; npm `web-vitals-polyfill-core-v1` chinazhangsan service-worker hijack via DoH + Sepolia-adjacent PWA_ROUTER; pip `bfox-build-utils` GitHub-Actions workflow-injection worm; npm `dotenv-precheck` Telegram wallet-mnemonic infostealer; npm `fabric-loader-core` install-time `vm.runInContext` RCE; npm `mfahelper` unpinned-GitHub-tarball RCE; npm `get-power` self-deleting AES payload typosquatting `get-proto`; npm `jexkcode` Baileys silent WhatsApp newsletter-follow; npm `zeal-utils`/`zeal-util-hooks` aveliscare canary continuation; pip `queeuees` .py-comment vandalism; 15 npm CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-09-30-ghsa-malware-sweep.md) - 2026-09-30 · high · advisory sweep · npm, PyPI · 26 packages. GHSA 2026-09-29 (late) + 2026-09-30: 27 new advisories - 25 npm + 2 pip. Cluster A is a fresh EtherHiding sample (`tailwind-forms-kit`, ETH wallet `0xa322E5...63e1a`) on Ethereum mainnet RPCs. Cluster B extends the `chinazhangsan.ccwu.cc` service-worker hijack family (`web-vitals-polyfill-core-v1`) using DoH lookups. Cluster C is a pip GitHub-Actions worm (`bfox-build-utils`) that self-installs `.github/workflows/ci-health-check.yml`. Clusters D-J are single-package droppers, stealers, and canaries; Cluster K is 15 CWE-506 boilerplate takedowns with no analysis. - [GitHub Advisory malware sweep - 2026-09-28 (late) + 2026-09-29 (donutautosellsrc campaign extends to pip `aseitylab` day 3; npm `hardhat-*` pino-impersonator Ethereum-dev lure; npm `nebula-*` Windows `.kntrat` RAT dropper family; npm `fabric-*` Minecraft credential stealer via Discord webhook; npm `chalk-figlet` family Windows RuntimeBroker.exe dropper; npm `dotenv`-lookalike JPEG-EXIF steganography → PowerShell chain; npm `simple-date-formatter-new-12` OAST SSRF probe)](https://dependencywatch.io/incident/multi-2026-09-29-ghsa-malware-sweep.md) - 2026-09-29 · high · advisory sweep · npm, PyPI · 25 packages. GHSA 2026-09-28 (late) + 2026-09-29: 26 new advisories - 25 npm + 1 pip. Cluster A extends the `donutautosellsrc` Polygon-blockchain-C2 pip campaign to `aseitylab` (day 3, 6 packages now under wallet `0x9c0a507300fd902787bb193d80fca5ce6e1bff9a`). Clusters B-F are four distinct npm operators active in the window: hardhat pino-impersonator, `nebula-*` Windows `.kntrat` RAT, `fabric-*` Minecraft-credential Discord-webhook stealer, `chalk-figlet` RuntimeBroker.exe dropper. Cluster K is 4 npm CWE-506 boilerplate takedowns with no analysis. - [GitHub Advisory malware sweep - 2026-09-27 (late) + 2026-09-28 (donutautosellsrc campaign extends to pip `aseity`, `coinscan`, `donutpromotion`, `claudedashbord`; pip `scrapetools2` novel IPFS-gateway auto-updater; pip `caracas4check` targeted setup.py remote-EXE; pip `metrio`/`metrics-sdk` sentinel-version pentest recon; 15-package npm CWE-506 boilerplate batch with no published analysis)](https://dependencywatch.io/incident/multi-2026-09-28-ghsa-malware-sweep.md) - 2026-09-28 · high · advisory sweep · npm, PyPI · 23 packages. GHSA 2026-09-27 (late) + 2026-09-28: 23 new advisories - 8 pip + 15 npm. Cluster A extends yesterday`s `donutautosellsrc` Polygon-blockchain-C2 campaign to 4 more pip packages sharing the same payload hash and attacker wallet. Cluster B `scrapetools2` uses IPFS gateways for auto-update payload distribution. Cluster E is a 15-package npm CWE-506 boilerplate batch with no published analysis - likely a mix of typosquats, dep-confusion probes, and unknown-classification takedowns. - [GitHub Advisory malware sweep - 2026-09-26 (late) + 2026-09-27 (pip `donutautosellsrc` steganographic infostealer + Polygon-blockchain C2 resolver; pip `requests-cache-utils` `setup.py` remote-EXE downloader/browser-data infostealer; npm `chai-as-relay` `pino` impersonator with 4.4MB obfuscated IIFE loaded on import; npm `cma-self-hosted-sandbox-cf` preinstall `/etc/passwd`+`/etc/hosts`+DNS recon exfil to `oastify.com` OOB. No fresh `ltidi.storage.googleapis.com` or `algamil7x` variants in the window)](https://dependencywatch.io/incident/multi-2026-09-27-ghsa-malware-sweep.md) - 2026-09-27 · high · advisory sweep · npm, PyPI · 4 packages. GHSA 2026-09-26 (late) + 2026-09-27: 4 new advisories - 2 pip + 2 npm not caught by yesterday`s sweep. Worst confirmed items are pip `donutautosellsrc` (steganographic loader + Polygon-blockchain-resolved C2 + native infostealer) and pip `requests-cache-utils` (`setup.py`-installed remote EXE + browser data exfil). npm `chai-as-relay` impersonates `pino` and loads a 4.4MB obfuscated IIFE on import. npm `cma-self-hosted-sandbox-cf` preinstall harvests `/etc/passwd`+`/etc/hosts`+DNS config to a Burp Collaborator OOB host. - [GitHub Advisory malware sweep - 2026-09-25 (late) + 2026-09-26 (pip `sherpy` Chrome-wallet + Telegram infostealer; pip `reqparser` crypto-wallet + browser + keylogger + persistence loader; pip `tego-managed-agents-test` `setup.py` env-var exfil; npm `@airbnb-extended/typescript-config` `@airbnb`-typosquat with external `ltidi.storage.googleapis.com` tarball loader; npm `shoplist-app` + `@digift/cli` dep-confusion / Pipedream beacon probes; npm `@nubjs/types` + `app-sca-info-banking` CWE-506 boilerplate takedowns. No fresh `oob.algamil7x.xyz` day-8 additions caught in the window)](https://dependencywatch.io/incident/multi-2026-09-26-ghsa-malware-sweep.md) - 2026-09-26 · high · advisory sweep · npm, PyPI · 8 packages. GHSA 2026-09-25 (late) + 2026-09-26: ~8 new advisories - 4 pip + 4 npm not caught by yesterday`s sweep. Worst confirmed items are pip `sherpy` (Chrome-extension crypto-wallet + Telegram infostealer) and pip `reqparser` (crypto-wallet + browser + keylogger + persistence). npm `@airbnb-extended/typescript-config` typosquats `@airbnb/typescript-config` and pulls an external tarball from a Google Cloud Storage bucket. No fresh `algamil7x` day-8 entries appeared in the window. - [GitHub Advisory malware sweep - 2026-09-24 (late) + 2026-09-25 (npm `@nf-addons/am-global-header` + `@osl-design/react` `oob.algamil7x.xyz` DNS-OOB day-7 late-adds missed by yesterday`s sweep; `n8n-nodes-moonlet-helpers`/`-utils`/`n8n-nodes-flowstats` `mkicom.com` fake `.well-known/pki-validation/` dropper family with `104.21.3.16` bare-IP + magic-key RCE; `secure-env3` + `better-dotenv3` JPEG-APP13/APP14 hidden VBS/PowerShell Windows dotenv typosquat dropper family; `agency-test-exercise` + `agency-testts` `wscript.exe 4444.vbs` AES+ChaCha20 Windows dropper; `chromatitle` + `chromatitle-js` ANSI-color-lure obfuscated fetch-and-execute; `wallet-connect-adapter` Windows XOR-encrypted Python dropper; `simple-date-formatter-new-11/13/14/15` continuation of the `124.221.154.135` SSH-key + `oast.fun` campaign (13/14/15 new C2 hosts); `aliftech-ui` + `@birbalo/aliftech-ui` shared-`webhook.site` dep-confusion siblings; `@alphaspace/core` Yahoo-internal dep-confusion Pipedream + istio/yahoo DNS recon; `eslint-config-compact-base` AWS API Gateway CI recon; `c2-client` postinstall command channel; pip `prosocks` proxy-network hijack campaign + `my-private-pkg` + `vercel-runtime-python` Vercel dep-confusion pentests)](https://dependencywatch.io/incident/multi-2026-09-25-ghsa-malware-sweep.md) - 2026-09-25 · high · advisory sweep · npm, PyPI · 24 packages. GHSA 2026-09-24 (late) + 2026-09-25: ~24 new npm advisories + 3 pip. Two `oob.algamil7x.xyz` day-7 late-adds yesterday`s sweep missed (`@nf-addons/am-global-header`, `@osl-design/react`). New `n8n-nodes-*` `mkicom.com` dropper family. `secure-env3`/`better-dotenv3` JPEG-hidden Windows dropper family. `simple-date-formatter-new-11/13/14/15` extend the `124.221.154.135` campaign. `@alphaspace/core` targets Yahoo internal builds. - [GitHub Advisory malware sweep - 2026-09-23 (late) + 2026-09-24 (npm `@baanx/*` + `@insiderintelligence/componentlibrary` `oob.algamil7x.xyz` DNS-OOB day 7; `@rixxcodex/baileys` + `sea-baileys` Baileys-wave WhatsApp session-hijack extension; `pino-testkit` chai/pino/jsonspack family Function-constructor RCE; `vite-dev-launcher` `~/.gradle/caches/` sibling of yesterday`s `@vitemirrorte` mall4cloud-react RAT; pip `memoryos` maintainer-compromise infostealer + npm `@memtensor/memos-cloud-openclaw-plugin` openclaw plugin; `internallib_v657` + `internallib_v463` RFC1918 `10.0.73.186:443` curl-pipe reverse shell (new subnet vs v497/v550 `10.0.5.109`); `godzz`/`godzzz` Cloudflare-Worker + Groq API key exfil siblings; `com.apple.unityplugin.storekit` + `simplenewnpmpackage` shared `dapnhid534ch...oast.fun` recon beacons; `a-onesite`, `event-hunter`, `helpersutils-dev-tools` beacon-only probes; `hachutis` undeclared-binary trycloudflare tunnel; rubygems `wurl_show_data`)](https://dependencywatch.io/incident/multi-2026-09-24-ghsa-malware-sweep.md) - 2026-09-24 · high · advisory sweep · npm, PyPI, RubyGems · 20 packages. GHSA 2026-09-23 (late) + 2026-09-24: ~25 new npm advisories + 1 pip + 1 rubygems. Day 7 of the `oob.algamil7x.xyz` DNS-OOB operator adds `@baanx/common`, `@baanx/domain`, and `@insiderintelligence/componentlibrary`. `vite-dev-launcher@2.9.4` is a mall4cloud-react-RAT sibling of yesterday`s `@vitemirrorte`. `internallib_v657/v463` reverse shell to a new RFC1918 subnet. - [GitHub Advisory malware sweep - 2026-09-22 (late) + 2026-09-23 (npm `@tvg-mar/*` + `@user-services/web-components` `oob.algamil7x.xyz` DNS-OOB day 6 at `9.9.10`; `hardhat-hold` axios-loader RCE typosquat wave extension; `chai-as-viem` + `chai-logger` chai/pino/jsonspack axios-loader family extension; `envforge/envparse` 6-package coordinated typosquat batch; `@wizloft/harness-*` 15-package Aug-Sep buildup batch quarantine; `oracle-redis` + `turbo-ws` transitive-dependency trojans; `@vitemirrorte/element-plus-vite-cli` `npmjs.it.com` mall4cloud-react-targeted RAT; `@gsutevil/hta-stage` Windows HTA/WSH MSI loader; org-internal dep-confusion cluster (`@tesla-insurance`, `devplatform-sdk`, `uolcs-host-uol-anuncios-fe`, `bnpl-blocks-*`, `bigops-*`, `agora402-payment-utils`, `ubiquiti-agents-link-mcp`, `internallib_v497/550` at RFC1918 `10.0.5.109`, `cisco-github-simple` oastify.com); pip `auclean` cloud-credential infostealer + `snap-queue`/`crypto-trader-py`/`poly-check-b` silent-install campaign + `kerokwis` pypi+rubygems telemetry; pentest `cloushaar-poc-exfil-91827` pip; ~60 random-name bulk quarantines)](https://dependencywatch.io/incident/multi-2026-09-23-ghsa-malware-sweep.md) - 2026-09-23 · high · advisory sweep · npm, PyPI, RubyGems · 76 packages. GHSA 2026-09-22 (late) + 2026-09-23: ~120 new npm advisories + 5 pip + 2 rubygems. Day 6 of the `oob.algamil7x.xyz` DNS-OOB operator adds `@tvg-mar/*` and `@user-services/web-components` at `9.9.10`. `@vitemirrorte/element-plus-vite-cli@2.9.1` is a full Node RAT with `npmjs.it.com` C2 targeting `mall4cloud-react`. pip `auclean` steals cloud credentials. - [GitHub Advisory malware sweep - 2026-09-21 (late) + 2026-09-22 (npm `@baanx/abis` + `@baanx/blockchain-config` `oob.algamil7x.xyz` DNS-OOB day 5; `hardhat-base` + `hardhat-core` + `hardhat-devkit` Ethereum-toolchain typosquats with axios-loader RCE via `ipcheck-hashed.vercel.app`; `@uh-platform/*` + `@uol-afiliados/affiliated-config-lib` + `@asdfaskdjfksadhfkasf` Burp Collaborator `oastify.com` dep-confusion; `@vite-*/*` six-package batch quarantine; `test-react-app-{in,out,way}` + `de-morgan` + `transform-es2015-unicode-regex` + `emoji-prints-fancy` Aug 4 residual typosquat quarantine; `math-universe`/`mathmain`/`mathsbase` batch quarantine; pip `pullgetsage` Telegram Desktop tdata stealer; `blue-string-formatter-utilss` `xss.report` DOM loader; pentest/CTF artefacts (`bnppf-flag-icons`, `radio-player-theme`, `my-ctf-helper-script-9921`, `bytepack-probe-a7x3`, pip `starlette-healthchecks`))](https://dependencywatch.io/incident/multi-2026-09-22-ghsa-malware-sweep.md) - 2026-09-22 · high · advisory sweep · npm, PyPI · 39 packages. GHSA 2026-09-21 (late) + 2026-09-22: ~25 new npm advisories + 2 pip. Day 5 of the `oob.algamil7x.xyz` DNS-OOB operator adds `@baanx/abis` and `@baanx/blockchain-config` at `9.9.11`. Three `hardhat-*` typosquats (Ethereum toolchain) carry real axios-loader RCE via `ipcheck-hashed.vercel.app`. `@uh-platform/*` (5 pkgs) plus `@uol-afiliados` and `@asdfaskdjfksadhfkasf` fire Burp Collaborator OOB. pip `pullgetsage` archives Telegram Desktop `tdata` and POSTs to Cloudflare Workers. - [GitHub Advisory malware sweep - 2026-09-20 + 2026-09-21 (npm `@nimbusedge2/*` + `@nimbsuedge3/xar` `147.93.157.202` reverse-shell dep-confusion continuation of 2026-09-12 Cluster G; `@baanx/solana-lib` `oob.algamil7x.xyz` DNS-OOB day 4; `test1*` + `chat-adapter-matrix` `128.199.122.145` / `pipedream.net` dep-confusion probe wave; `chai-testing` obfuscated axios-loader require-time RCE; `npmscript_tesstalert_unpkg` `webhook.site` cookie exfil; `@pwaplatform/module-sso-integration` `99.0.x` sentinel; `testmgkregme` binding.gyp GYP-expansion loader)](https://dependencywatch.io/incident/multi-2026-09-21-ghsa-malware-sweep.md) - 2026-09-21 · high · advisory sweep · npm · 19 packages. GHSA 2026-09-20 + 2026-09-21: 18 new npm advisories (plus 1 from 09-20). Day 4 of the `oob.algamil7x.xyz` DNS-OOB operator (`@baanx/solana-lib` `bxsol` prefix). Continuation of the 2026-09-12 `@nimbusedge/auth` dep-confusion reverse-shell operator: six new `@nimbusedge2/*` + `@nimbsuedge3/xar` packages shell out to `147.93.157.202:8080` and beacon `canarytokens.com`. A dep-confusion probe wave (`test1*`, `chat-adapter-matrix`) targets bare-IP `128.199.122.145` and Pipedream. `chai-testing` and `testmgkregme` add real require-time RCE. - [GitHub Advisory malware sweep - 2026-09-19 late + 2026-09-20 (pip `urc@99.99.99` install-time host-info exfil probe; light day, one entry)](https://dependencywatch.io/incident/multi-2026-09-20-ghsa-malware-sweep.md) - 2026-09-20 · medium · advisory sweep · PyPI · 1 package. GHSA 2026-09-19 late + 2026-09-20: only one new advisory in the 24h window - pip `urc@99.99.99` (GHSA-3c7m-3qhf-wqrr, MAL-2026-16298), a `setup.py`-override install-time host-info exfiltrator (IP + username) flagged by GHSA as `PROBABLY_PENTEST` under campaign `GENERIC-standard-pypi-install-pentest`. Cataloguing depth reserved for the corresponding named incident when a payload appears; no worm / hijack / typosquat cluster in this window. - [GitHub Advisory malware sweep - 2026-09-18 late + 2026-09-19 (npm `algamil7x.xyz` DNS-OOB scope expansion `@shared-web/utils`/`@shared-web/assets`/`@shared-runtime/modules`/`@insiderintelligence/googleadmanager` day 2; `test89-auth`/`test890-auth`/`test899-auth`/`test8999-auth` dep-confusion probe siblings of yesterday`s `test89078-auth`; on-chain Ethereum-C2 `tailwindcss-form@<=0.5.1` + `tailwindcss-forms-ui@<=0.5.2` day 2 of `0xa322E5f3...`; `@sanzoffc/baileys@<=3.0.4` newsletter-follower + unpinned `@whiskeysockets/eslint-config` github ref; `chai-as-indexed@<=7.2.8` `ipcheck-hashed.vercel.app` full-`process.env` exfil + `new Function()` RCE; `x509-escaping@0.0.0-0.0.2/1.0.1` Burp Collaborator `oastify.com` recon; `internallib_v949`, `sinful`, `openmct-heatmap`, `ac-polyfills` CWE-506; pip `py-venv-doctor@0.1.0/0.1.1` full-env-var telemetry exfil; pip `google-cloud-datacatalog-lineage-producer-client@9999`/`99999999`/`0.2.7` google-cloud-* dep-confusion sentinel; npm `keroeltop@99.99.99` malicious-domain probe)](https://dependencywatch.io/incident/multi-2026-09-19-ghsa-malware-sweep.md) - 2026-09-19 · high · advisory sweep · npm, PyPI · 20 packages. GHSA 2026-09-18 late + 2026-09-19: 4x npm `@shared-*` + `@insiderintelligence/*` scopes at sentinel `9.9.10` extend yesterday`s `algamil7x.xyz` DNS-OOB campaign into fresh internal-lookalike scopes (day 2, same operator); 4x `test89*-auth` dep-confusion probes continue the `test89078-auth` cluster; on-chain Ethereum-C2 `tailwindcss-form*` typosquats republish under `0xa322E5f3...` (day 2); `chai-as-indexed` POSTs the full `process.env` to `ipcheck-hashed.vercel.app` and evals the response; pip `py-venv-doctor` exfils environment variables via a fake healthcheck telemetry channel. - [GitHub Advisory malware sweep - 2026-09-17 late + 2026-09-18 (npm Baileys-fork `libsignal`-hijack wave `xzvbailey`/`xzvbailsx`/`zero-baileys`/`@lekzo/baileys` unpinned GitHub-ref RCE; `blue-string-formatter-utils` `xss.report/c/k3rne111` require-time eval loader; `@railone/image-utils` `api.npoint.io/641d37178a880b1e8b8f` sibling of `process-lhpm`/`process-mite`; `xa424234657567` `duel.com` host-gated `unpkg.com/x6842179305` remote payload; `tailwindcss-form-utils`/`-form-ui` Ethereum-on-chain C2 (`0xa322E5f3...` publicnode/drpc/1rpc); `@tink/tink-link-core@9.9.10` + `test89078-auth@99.99.99` dep-confusion DNS OOB pair; pip `requests-auroras`/`-triwes`/`-asetwe` `2.34.2` setup.py reverse shells + probes; pip `marketing-mcp` webhook.site SSH/AWS-key exfil MCP tool; pip `aiosendletter`/`index-forum`/`pyjstat-smooth` cloned-legit file exfil; npm `kartykgithub-multiversion-a` pentest continuation; 25x `lisa-*` tea.xyz autopublish flood)](https://dependencywatch.io/incident/multi-2026-09-18-ghsa-malware-sweep.md) - 2026-09-18 · high · advisory sweep · npm, PyPI · 51 packages. GHSA 2026-09-17 late + 2026-09-18: 4x npm Baileys-fork packages redirect `libsignal` to unpinned GitHub refs for install-time RCE; `blue-string-formatter-utils` runs `xss.report` XMLHttpRequest+eval on require; `@railone/image-utils` reuses the `api.npoint.io` loader pattern of `process-lhpm`/`process-mite`; `tailwindcss-form-*` typosquats fetch commands from an attacker-authored Ethereum address; pip `marketing-mcp` exfils `~/.ssh/id_rsa` + `~/.aws/credentials` via a webhook.site endpoint. - [GitHub Advisory malware sweep - 2026-09-16 late + 2026-09-17 (13x `strapi-plugin-*-meeb` port-80 hostname-gated (`ubuntu-fc-uvm`) reverse-shell follow-on to 14.225.210.85:80; `strapi-plugin-osag`/`os-rec` Burp Collaborator OOB recon; `@traktis/environment` + `@traktis/core` dep-confusion pair to `tko.amgsec.com`; `process-mite` npoint.io remote-code loader sibling of `process-lhpm`; `jexkcode` Baileys WhatsApp newsletter-follower; `kartyk-github-*` CWE-506 pentest artefacts; pip `praetorian-mind-rce-test-2026` env exfil + `trongappy` Tron key stealer + `rak-lab-yoav-orca-*` dep-confusion; npm `idx_form_script@999.0.4` 2026-09-17 dep-confusion probe)](https://dependencywatch.io/incident/multi-2026-09-17-ghsa-malware-sweep.md) - 2026-09-17 · high · advisory sweep · npm, PyPI · 28 packages. GHSA 2026-09-16 late + 2026-09-17: 13 more `strapi-plugin-*-meeb` reverse-shell packages targeting `14.225.210.85:80` with `ubuntu-fc-uvm` hostname gating; `-osag`/`-os-rec` Burp Collaborator OOB recon variants from the same operator; `@traktis/environment`+`@traktis/core` dep-confusion pair exfiltrating CI env vars to `tko.amgsec.com`; `process-mite` reuses the same `api.npoint.io` loader as yesterday`s `process-lhpm`; `jexkcode` is another Baileys newsletter-follower. - [indexed-btree + 9 sibling npm packages: runtime-triggered loader, Ethereum Sepolia smart-contract C2 (Checkmarx disclosure)](https://dependencywatch.io/incident/npm-2026-09-17-indexed-btree-sepolia-etherhiding.md) - 2026-09-17 · critical · malicious package · npm · 10 packages. Checkmarx disclosed on 2026-09-17 that npm user `charlessadler25` had published `indexed-btree` (impersonating `sorted-btree`) plus 9 sibling packages, together reaching ~2M weekly downloads before npm removed them on 2026-09-03. The loader lives inside `BTree.prototype.set()` - not a lifecycle hook - and resolves its C2 by polling an Ethereum Sepolia smart contract (EtherHiding), exfiltrates via Slack and Telegram, and is tied to a wallet holding 109 ETH. - [visanduma/nova-two-factor - PolinRider malware planted in four dev-* branches via compromised Visanduma GitHub org](https://dependencywatch.io/incident/packagist-2026-09-17-visanduma-nova-two-factor-polinrider.md) - 2026-09-17 · high · compromise · Packagist · 1 package. Socket disclosed on 2026-09-17 that the DPRK-linked PolinRider operators compromised the `Visanduma` GitHub organisation and implanted staged infostealer code in the `dev-main`, `dev-nova4support`, `dev-using-inertia`, and `dev-nova5` branches of `visanduma/nova-two-factor`, a Laravel Nova 2FA package on Packagist with ~700K cumulative downloads. No stable release is affected; Packagist has frozen the package. - [GitHub Advisory malware sweep - 2026-09-15/16 (npm `plogme` Baileys WhatsApp fork with `crysnovax.link` fingerprinting; `webpackbootstrap5`/`webpackbootstrapscripts`/`@zaka13/thing` in-browser Scramjet proxy typosquat kit; pip `faiss-cpu-avx512` FAISS typosquat with `catbox.moe` `indexwrm` daemon; 14x npm `strapi-plugin-*-meeb`/`-meeb322k` bulk reverse-shell wave to 14.225.210.85:443; `process-lhpm` npoint.io remote-code loader; `fulfillment-cuprum-auth-widget`/`alkajsdfoiwqeusdflkjsdf` dr0gas.com env exfil; `csa-mfa` dep-confusion probe)](https://dependencywatch.io/incident/multi-2026-09-16-ghsa-malware-sweep.md) - 2026-09-16 · high · advisory sweep · npm, PyPI · 25 packages. GHSA 2026-09-15 late + 2026-09-16: `plogme` is a malicious Baileys WhatsApp fork fingerprinting to `crysnovax.link`; three `zaka13` npm packages ship an in-browser Scramjet proxy loader; pip `faiss-cpu-avx512` typosquats FAISS with a `catbox.moe` daemon; 14 `strapi-plugin-*-meeb`/`-meeb322k` packages drop reverse shells to `14.225.210.85:443`; `process-lhpm` fetches remote JS from `npoint.io`. - [GitHub Advisory malware sweep - 2026-09-14/15 (npm `pino-ulid` cross-platform persistent RAT typosquat, `noblox-asset.js` Roblox typosquat with TRLX.exe Windows binary, `n8n-nodes-sysdiag`/`sysdiag2` n8n community-node credential exfil, `concierge-sdk` dep-confusion with Azure IMDS + GITHUB_TOKEN theft, `@aiwfm/communitywfm.scripts.api` Cloudflare Workers env exfil, `get-power`/`postgreesqlhelper` get-proto base64+eval RCE)](https://dependencywatch.io/incident/multi-2026-09-15-ghsa-malware-sweep.md) - 2026-09-15 · high · advisory sweep · npm · 23 packages. GHSA 2026-09-14/15 (npm-only day): `pino-ulid<=2.12.3` is a persistent multi-OS RAT typosquat impersonating `pino`+`ulid`; `noblox-asset.js` v7.4.0-7.4.2/7.6.0 impersonates the Roblox `noblox.js` API wrapper and drops the `TRLX.exe` Windows binary; `n8n-nodes-sysdiag`/`sysdiag2` are n8n community-node credential exfilters; `concierge-sdk@99.99.99+` is a dep-confusion probe that actually hits Azure IMDS and `GITHUB_TOKEN`; plus `@aiwfm/communitywfm.scripts.api` Cloudflare Workers env exfil and get-proto typosquat RCE loaders. - [GitHub Advisory malware sweep - 2026-09-13/14 (`chroma-client` continues `2026-09-openaii` AI SDK typosquat wave, `python-fork` PyPI fork bomb, `job-iteration` npm CWE-506, huge `joko-*` Indonesian-food tea.xyz spam explosion with autopublish sources `joan-teadev`/`joknmax`, `joint_*_z3n`/`_0xrequest` continuation, `joker123`/`joker388` casino spam)](https://dependencywatch.io/incident/multi-2026-09-14-ghsa-malware-sweep.md) - 2026-09-14 · high · advisory sweep · npm, PyPI · 58 packages. GHSA 2026-09-13/14: PyPI `chroma-client` extends the `2026-09-openaii` typosquat wave (`chromadb` typosquat, same infostealer+cryptominer payload as `openaii`/`langgrap`/`transfomers`/`ollamaa`); PyPI `python-fork` is a plain import-time fork bomb; npm `job-iteration` flagged as CWE-506 malware. Otherwise the day is a massive tea.xyz autopublish spam wave — hundreds of `joko-{Indonesian food}-{suffix}` names sourced from `joan-teadev`/`joknmax` autopublish scripts, plus `joint_*_z3n`/`joint_*_0xrequest` continuation of the 2026-09-11 `family_*_z3n` operator and `joker123`/`joker388` casino-themed spam. - [GitHub Advisory malware sweep - 2026-09-11/12 (`greensaver` jsonkeeper AES continuation, `tailwind-form-kit` EtherHiding continuation, `2026-09-openaii` AI SDK typosquat wave `langgrap`/`openaii`/`transfomers`/`ollamaa`, `eth-account`/`web3-eth-account` blockchain-C2 pair, `@nimbusedge/auth` dep-confusion reverse shell)](https://dependencywatch.io/incident/multi-2026-09-12-ghsa-malware-sweep.md) - 2026-09-12 · high · advisory sweep · npm, PyPI · 16 packages. GHSA 2026-09-11/12: `greensaver` continues the `jsonkeeper.com/b/V6NBX` AES operator (4th package in 5 days); `tailwind-form-kit` continues the `0xa322E5…` EtherHiding operator; new `2026-09-openaii` PyPI wave hits `langgrap`/`openaii`/`transfomers`/`ollamaa`; `web3-eth-account`/`eth-account-web3` fetch payload URLs from a smart contract; `@nimbusedge/auth` drops a reverse shell. - [GitHub Advisory malware sweep - 2026-09-10/11 (`pinochiomathm` picomatch typosquat with AES payload, `tailwindcss-contact-forms` Ethereum-RPC wallet drainer, `lucy-python-script-2030` Telegram infostealer, `@fyxzpediaa/baileys` wave 4, tea.xyz mass spam wave)](https://dependencywatch.io/incident/multi-2026-09-11-ghsa-malware-sweep.md) - 2026-09-11 · high · advisory sweep · npm, PyPI · 111 packages. GHSA published between 2026-09-10 and 2026-09-11 UTC: a `picomatch` typosquat (`pinochiomathm`) with AES payload from `jsonkeeper.com`, `tailwindcss-contact-forms` Ethereum-RPC wallet drainer, a PyPI Telegram infostealer, a fourth Baileys hijack (`@fyxzpediaa/baileys`) - plus a very large tea.xyz spam wave (hundreds of `fancy_*_z3n` / `famous_*_z3n` / `family-island-unlimited-energy*` packages). - [GitHub Advisory malware sweep - 2026-09-09/10 (Baileys wave 3, `@umschool/platform` K8s harvester, "Master Harvester" Solana wallet drainers, Discord MFA lures)](https://dependencywatch.io/incident/multi-2026-09-10-ghsa-malware-sweep.md) - 2026-09-10 · high · advisory sweep · npm, PyPI · 28 packages. Between 2026-09-09 and 2026-09-10 UTC GHSA published ~26 new npm/PyPI malware advisories: a third Baileys WhatsApp scope-hijack wave, a `@umschool/platform` follow-up that adds a live Kubernetes-secrets + cloud-metadata harvester, a shared "Master Harvester" template hitting Solana wallets via `gmgn-trading-kit` and `soltinel-pro`, a coordinated Discord MFA lure trio, plus BigQuery/Databricks PyPI probes and boilerplate takedowns. - [GitHub Advisory malware sweep - 2026-09-08/09 (coordinated `sonner` typosquat trio, Baileys scope hijacks, `rojo-rbx` Windows persistence, dep-confusion probes and remote-code loaders)](https://dependencywatch.io/incident/multi-2026-09-09-ghsa-malware-sweep.md) - 2026-09-09 · high · advisory sweep · npm, PyPI · 25 packages. Between 2026-09-08 and 2026-09-09 UTC GHSA published ~25 npm/PyPI malware advisories: a coordinated `sonner` typosquat trio (`sonmors`/`gloggo`/`file-type-detector`) with a PNG-steganography loader gated on a fake `isSign()`; three `@*/baileys` WhatsApp scope hijacks; a `rojo-rbx` Roblox typosquat with Windows Run-key persistence; plus dep-confusion probes and remote-code loaders. - [GitHub Advisory malware sweep - 2026-09-07/08 large corporate-namespace dep-confusion wave (Air Canada, Medisend, OPAP, Optimizely/Fastly, MATLAB/Azure DevOps, SimpliSafe, Tidal, PayPal, Twilio, Afterpay, Ecobee, Karapace, Glia, Jobber, Feishu, BMC, Coinbase-adjacent) + oast.online-beaconed probe cluster + 2026-09-08 fresh drops](https://dependencywatch.io/incident/multi-2026-09-08-ghsa-malware-sweep.md) - 2026-09-08 · high · advisory sweep · npm, PyPI · 71 packages. Between 2026-09-07 and 2026-09-08 UTC GHSA flushed 100+ npm advisories in a single wave dominated by corporate-namespace dep-confusion probes (Air Canada, Medisend, Swisscom, OPAP, Optimizely/Fastly, MATLAB/Azure DevOps, SimpliSafe, Tidal, PayPal, Twilio, Afterpay, Ecobee, Karapace, Glia, Jobber, Feishu, BMC, and more). Two probes exposed shared IOCs (oast.online + 5.189.159.252). Plus 2026-09-08 fresh drops (`krdpass-auth-react-native`, PyPI `telegram-helper`). - [Coinbase / Base / Smart Contract Wallet internal-namespace dep-confusion drop (13 packages, `cb-wallet-*` + `base-*` + `scw-*` + `wallet-*`)](https://dependencywatch.io/incident/npm-2026-09-07-coinbase-base-cb-wallet-dep-confusion.md) - 2026-09-07 · critical · dependency confusion · npm · 13 packages. On 2026-09-07 GitHub Advisory flagged 13 new npm packages under names that exactly match Coinbase internal namespaces: `cb-wallet-*` (7 pkgs), `base-account-core`/`base-app-data`, `scw-mobile`/`scw-core`, `wallet-engine-signing`, `wallet-cds-web`. All carry the full-compromise malware boilerplate. Classic dep-confusion probe against Coinbase Wallet, Base L2, and Smart Contract Wallet builds. - [GitHub Advisory malware sweep - 2026-09-06/07 alphabetical E-range backfill: tea.xyz `eka-*` Indonesian-food autopublish flood (~100 pkgs), `eigenstate-*` tea.xyz self-replicating spam (~15 pkgs), z3n research-pattern `effective_/efficient__z3n` spam (~35 pkgs), and misc E-prefix opportunistic drops](https://dependencywatch.io/incident/multi-2026-09-07-ghsa-malware-sweep.md) - 2026-09-07 · high · advisory sweep · npm · 186 packages. Yesterday's (Sept 6) sweep captured 13 npm items; the queue then flushed ~200 more, mostly published as of 2026-09-06 and continuing into 2026-09-07. Three coherent clusters (tea.xyz `eka--` autopublish, tea.xyz `eigenstate---` autopublish, and `effective_/efficient__z3n` research spam) plus a long tail of misc E-prefix drops. - [GitHub Advisory malware sweep - 2026-09-05/06 batch (`@liuliang520500/*` Chinese e-commerce SDK impersonators + `@domyjs/*` reactive-framework typosquats + `date-fns-formatter` date-fns typosquat + `trongridew` PyPI Tronix private-key exfil + `proxycer`/`dbt-sa-cli` generic PyPI install-time exfil)](https://dependencywatch.io/incident/multi-2026-09-06-ghsa-malware-sweep.md) - 2026-09-06 · high · advisory sweep · npm, PyPI · 27 packages. Tail sweep after yesterday's batch. 6 `@liuliang520500/*` npm packages impersonate Sina Taoke, Pinduoduo, JD.com, and Taobao SDKs; 7 `@domyjs/*` npm packages typosquat a reactive-framework namespace; `date-fns-formatter` extends the date-fns typosquat family; `trongridew` (PyPI) is a Tron/TRX private-key exfil dropper; `proxycer`/`dbt-sa-cli` are install-time IP+username exfil pentest artefacts. - [GitHub Advisory malware sweep - 2026-09-04/05 batch (`houdus` Windows sandbox-detection dropper + `timeweave` Windows WinExec dropper + Box internal dep-confusion via `canarytokens.com` DNS + `tailwind-contact-forms` crypto-drainer typosquat + `line-through` + `real-router-telemetry` + `claude-channel-discord` recon + amirgo4496 PyPI dep-confusion campaign)](https://dependencywatch.io/incident/multi-2026-09-05-ghsa-malware-sweep.md) - 2026-09-05 · high · advisory sweep · npm, PyPI · 38 packages. Multi-ecosystem sweep. `houdus` (PyPI, Sept 5) is a Windows-only sandbox-detecting dropper; `timeweave` fetches Windows executables from `globaltimedata.com` via `WinExec`. Also: Box internal dep-confusion via `canarytokens.com` DNS, `tailwind-contact-forms` crypto-drainer typosquat, `line-through`/`real-router-telemetry` webhook.site exfil, and the `amirgo4496` PyPI dep-confusion campaign. - [GitHub Advisory malware sweep - 2026-09-04 batch (10-package npm-only day: `@bx-ui-framework/*` + `grivy-packages.com` remote-tarball hijack clusters + `@yuva2210/okx-poc-rce-impact` + `@avigilon/node-webrtc` dep-confusion recon + `wallet-watcher` BIP-39/ETH-key AES-256-GCM stealer + `mcp-consultasdeveiculos-client` CLI-token OOB exfil + `vitest-cli-dev` remote-`new Function()` dropper)](https://dependencywatch.io/incident/multi-2026-09-04-ghsa-malware-sweep.md) - 2026-09-04 · high · advisory sweep · npm · 10 packages. 10-package npm-only sweep. Two remote-tarball hijack clusters (`@bx-ui-framework/*` via `artifactorymanager.com`/`remoteknight.com`; `@grab-food/order-sdk-web`+`lil-swisgom-hlepers` via `grivy-packages.com`), `wallet-watcher` BIP-39/ETH-key AES-256-GCM stealer, dep-confusion recon (OKX + Avigilon), and `vitest-cli-dev` remote-`new Function()` dropper. - [GitHub Advisory malware sweep - 2026-09-03 batch (10-package "Frankly Malicious" `frank`/`frengki0707` Indonesian dep-confusion campaign resurgence targeting Apple + Google/GCP + PyPI `2026-09-telemetry-helper` GitHub-Gist cred-exfil campaign + `@stellarshift/*` Lark/Feishu+FortiClient targeted enterprise supply chain + `tailwindcss-fluid-styles` CHAINDROP Ethereum-RPC on-chain C2 loader + `real-router-utils` webhook.site fingerprint)](https://dependencywatch.io/incident/multi-2026-09-03-ghsa-malware-sweep.md) - 2026-09-03 · high · advisory sweep · npm, PyPI · 29 packages. 19-package sweep: **Panther-tracked `frengki0707` "Frankly Malicious" actor resurfaces** with 10 apple-*/google-*/frank-* dep-confusion drops after ~4 months. PyPI `2026-09-telemetry-helper` campaign exfils env-vars to GitHub Gist via hardcoded PAT. `@stellarshift/*` (4 pkgs) targets Lark/Feishu+FortiClient endpoints; `tailwindcss-fluid-styles` uses CHAINDROP on-chain Ethereum C2. - [GitHub Advisory malware sweep - 2026-09-02 batch (PyPI `syswatch` Snow Stealer - third `2026-08-envprovision` campaign package + npm `eslint-rxjs@1.0.1` typosquat of `eslint-plugin-rxjs` + npm `eyiouss` + `twapfetch` CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-09-02-ghsa-malware-sweep.md) - 2026-09-02 · high · advisory sweep · npm, PyPI · 4 packages. PyPI `syswatch@1.0.0` is a **third package** in the `2026-08-envprovision` Snow Stealer campaign (browser + wallet infostealer, sandbox evasion, log wiping on Windows). npm `eslint-rxjs@1.0.1` typosquats `eslint-plugin-rxjs` (OpenSSF flagged: "communicates with a domain associated with malicious activity"). `eyiouss` and `twapfetch` are all-versions CWE-506 boilerplate npm takedowns. - [GitHub Advisory malware sweep - 2026-09-01 batch (19-package `@yane88/*` Windows dev-toolchain dep-confusion probe (IntelliJ IDEA 2026.2, Listary, Reqable, ripgrep, HexHub, WorkBuddy) + PyPI `pyservercheck` Lazarus/PolinRider EtherHiding v0.1.x + `kendo-angular-window` Telerik typosquat + `fuels-*` Fuel Labs SDK 4-package typosquat + `verify-contract-*`/`generate-schema-*` EVM smart-contract-verifier 4-package cluster + `hyperliquid-composer` DeFi typosquat + `@viertechjs/*` dep-confusion 3-pack (Baileys WhatsApp / API / wb) + `react-mongoose`/`express-mongo-limit` MongoDB stack typosquats + `bamru` clipboard/screen harvester (new-pointer.vercel.app C2) + PyPI `gcphelpit` GCP-help infostealer + PyPI `tallyboxlite` recon + CWE-506 boilerplate takedowns)](https://dependencywatch.io/incident/multi-2026-09-01-ghsa-malware-sweep.md) - 2026-09-01 · high · advisory sweep · npm, PyPI · 45 packages. 19-pkg `@yane88/*` scope probes internal Windows dev-tool naming; PyPI `pyservercheck@0.1.x` is a PolinRider EtherHiding stager (`.pth` persistence, blockchain C2); `fuels-*` (4) typosquats Fuel Labs SDK; `verify-contract-*`/`generate-schema-*` (4) targets viem+ethers verifiers; `bamru` is a clipboard/screen harvester (C2 `new-pointer.vercel.app`); PyPI `gcphelpit` is an infostealer. ## 2026-08 - [GitHub Advisory malware sweep - 2026-08-31 batch (npm `grafeno-actions@999.0.0` Wave 3 dep-confusion pivot + Deutsche Bank `Autobahn` Electron dep-confusion probe (`autobahn-electron-probe@99.99.1`, `com.db.autobahn.notification-center-electron@88.88.2`) + `fuels-*`/`verify-contract-*`/`generate-schema-*` web3-tooling typosquat cluster (6 packages) + PyPI `tronlinker` Tronix crypto-wallet-drain + late-arriving 2026-08-30 `*-codex`/`*fcrxz` clusters + late `trongridor` + `auth-app-streamlit` PyPI)](https://dependencywatch.io/incident/multi-2026-08-31-ghsa-malware-sweep.md) - 2026-08-31 · high · advisory sweep · npm, PyPI · 26 packages. Wave 3 of the `grafeno-*` Brazilian-fintech campaign lands as `grafeno-actions@999.0.0` - a pure dependency-confusion pivot after Waves 1-2's pre-install payload. Alongside it: a Deutsche Bank `Autobahn` Electron dep-confusion probe (2 pkgs), a 6-pkg web3 typosquat cluster (`fuels-*` / `verify-contract-*` / `generate-schema-*`), a PyPI Tronix drain, and 12 late-arriving 2026-08-30 advisories. - [GitHub Advisory malware sweep - 2026-08-30 batch (npm `grafeno-*` Wave 2 env-var stealer + reverse shell to 216.126.236.46:4444 (3 packages: `grafeno-webhook`, `grafeno-payments`, `grafeno-billing`) + npm CWE-506 takedown burst: `quesoeducation`, `opiumbest`, `gclassroom`)](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep.md) - 2026-08-30 · high · advisory sweep · npm · 6 packages. Second wave of the `grafeno-*` Brazilian-fintech-themed cluster surfaced on 2026-08-30: `grafeno-webhook`, `grafeno-payments`, and `grafeno-billing` (all v1.0.0) reuse the 216.126.236.46 C2 host from Wave 1 but swap the `x.sh` + crontab mechanism for env-var scraping (`AWS|TOKEN|KEY|SECRET|PASS|API`) + a reverse bash shell on port 4444. Plus three CWE-506 boilerplate takedowns: `quesoeducation`, `opiumbest`, `gclassroom`. - [GitHub Advisory malware sweep - 2026-08-29 batch (npm `access-token-delta` vercel.app remote-eval cluster (3, `eth-pino` + `js-array-tokens` + `js-tokens-array`) + npm `limbomail.com` Discord-MFA Windows dropper pair (`mfacord` + `mfakit`) + npm `secretkey2fa` Minecraft/Microsoft-account stealer + npm `supersignaturenature` RSA/DES chain via `manager-thedate` + npm `techportal` HTTP+DNS beacon to `oob.asm5.net` + npm `vs-modules` Windows .bat dropper + npm `vitest-chalk-pro` jsonbin.io detached-child C2 + npm `repo.securityctrl.com` mass dependency-confusion probe (18+ enterprise namespaces: Intuit, Atlassian, Firebase, Postman, Oracle, Amplitude, Ring, Alimama, Nx, Libra…) + npm `grafeno-*` preinstall + cron persistence cluster (9 packages, 216.126.236.46/x.sh) + PyPI `calcboxlite` + `pygame-renderkit` misc + massive scripted CWE-506 bursts (`3layerdipstack*` ~100+, `classlink-*` ~100+))](https://dependencywatch.io/incident/multi-2026-08-29-ghsa-malware-sweep.md) - 2026-08-29 · high · advisory sweep · npm, PyPI · 46 packages. Large 24h window ending 2026-08-29: the standout is a compromise of `@7nohe/openapi-react-query-codegen` by the "Trinitite" Mini Shai-Hulud continuation (tracked separately). Around it: three coordinated operator clusters with full IOCs (npm vercel.app remote-eval typosquats, npm `limbomail.com` Discord-MFA droppers, npm `repo.securityctrl.com` mass enterprise-namespace dependency-confusion probe), a `grafeno-*` cron-persistence cluster, and hundreds of scripted CWE-506 boilerplate burst-publishes (`3layerdipstack*`, `classlink-*`). - [GitHub Advisory malware sweep - 2026-08-28 batch (PyPI `flyteplugins-*` dependency-confusion cluster (4) + PyPI `discordnv` Discord/Roblox DPAPI infostealer + PyPI `decoris` Roblox cookie stealer + PyPI `sap-quarterly-report` + `ekx-report-utils` DNS-exfil pair + PyPI `mathkitlite` PROBABLY_PENTEST + npm `@postman-cse/okta-aio-darwin-arm64` internal-namespace dependency-confusion probe + npm `@hd-team/*` cluster (8) + npm `hydration-ui-dlx` / `svelte-ui-dlx` hydration-lookalike continuation + npm `tailwindcss-*` typosquats (2) + npm long-tail CWE-506 boilerplate)](https://dependencywatch.io/incident/multi-2026-08-28-ghsa-malware-sweep.md) - 2026-08-28 · high · advisory sweep · npm, PyPI · 36 packages. 31 new GHSA malware advisories in the 24h window ending 2026-08-28. Highlights: 4 `flyteplugins-*` PyPI packages all published at the identical exact version `2.6.10` - a dependency-confusion probe against Union.ai / Flyte internal package namespaces; PyPI `discordnv@0.8.0` steals Discord tokens plus DPAPI-decrypts Roblox cookies with full Discord-webhook + Google-Apps-Script + registry-persistence IOCs; PyPI `sap-quarterly-report` + `ekx-report-utils` share a DNS-exfil campaign; npm `@postman-cse/okta-aio-darwin-arm64` reads as a Postman internal `okta-aio` binary namespace hit. - [`@7nohe/openapi-react-query-codegen` compromised - "Trinitite" (Mini Shai-Hulud continuation) worm published 10 poisoned versions via a fork PR + `issue_comment` trigger without an author-association gate](https://dependencywatch.io/incident/npm-2026-08-28-trinitite-openapi-react-query-codegen.md) - 2026-08-28 · critical · compromise · npm · 1 package. On 2026-08-28 an attacker published 10 malicious versions of `@7nohe/openapi-react-query-codegen` (~150K npm weekly downloads) in a ~20-minute window. Root cause: an `issue_comment`-triggered GitHub Actions release workflow without an author-association gate - any GitHub user could open a fork PR, comment `npm publish`, and the pipeline checked out the fork, ran `pnpm install` (executing the attacker's preinstall hook) with `id-token: write` and minted an npm OIDC trusted-publishing token to ship the poisoned versions. Payload is a "Trinitite: Sponsored by Preview 2 Effects" credential-stealer worm continuing the Mini Shai-Hulud / TeamPCP lineage. - [GitHub Advisory malware sweep - 2026-08-27 batch (npm `hydration-vli-ui` ELF-in-JS Linux RAT + npm `commonjs-code-token` remote-eval C2 + npm `spotify-url-resolvers` Telegram-C2 project-dir exfil + npm `octopus-action` Burp Collaborator preinstall exfil + npm `chai-plus` `taskforge-9xv` second-stage installer + PyPI `pybitjs` Lazarus/PolinRider PTH-injection + PyPI `trongridet` TRX private-key exfil + PyPI PROBABLY_PENTEST cluster (4) + npm CWE-506 boilerplate (14))](https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep.md) - 2026-08-27 · high · advisory sweep · npm, PyPI · 24 packages. 24 new GHSA malware advisories in the 24h window ending 2026-08-27. Highlights: npm `hydration-vli-ui@1.0.0` ships a Linux x86_64 ELF disguised as JavaScript, on import establishes a full-featured RAT with SSH-key theft and systemd persistence; npm `commonjs-code-token` postinstall pulls a token from `access-token-delta.vercel.app` and `eval()`s it; npm `spotify-url-resolvers` archives the project directory (including `.env`) hourly to a Telegram bot; PyPI `pybitjs` is attributed to Lazarus/PolinRider with blockchain-based C2 delivery. - [GitHub Advisory malware sweep - 2026-08-26 batch (PyPI `envprovision` Snow Stealer + PyPI `minecraft-ytreceiver` Telegram-C2 webcam/keylogger + PyPI `python-walletlibr-v` Windows install-time dropper + npm `twork-data-services-*` internal-scope dep-confusion + npm `wm-*` dep-confusion + npm Vue/Svelte/Vite lookalike cluster (15) + npm CWE-506 boilerplate (5))](https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep.md) - 2026-08-26 · high · advisory sweep · npm, PyPI · 28 packages. 28 new GHSA CWE-506 advisories in the 48h window ending 2026-08-26. Highlights: PyPI `envprovision` drops "Snow Stealer" browser/wallet infostealer with sandbox evasion; PyPI `minecraft-ytreceiver` runs webcam/screenshot/keylogger over Telegram C2; PyPI `python-walletlibr-v` fires a Windows batch dropper at pip install; npm `twork-data-services-*` and `wm-*` clusters look like internal-namespace dep-confusion probes; a 15-package Vue/Svelte/Vite lookalike cluster and 5 CWE-506 boilerplate names round out the batch. - [GitHub Advisory malware sweep - 2026-08-25 batch (PyPI `msrcpoc` 99.1.9 OpenSSF PA malicious-command detonation + PyPI `multyproccess` `multiprocess` typosquat infostealer with browser/wallet/clipboard theft + npm boilerplate CWE-506 spray of 8 disposable throwaway names)](https://dependencywatch.io/incident/multi-2026-08-25-ghsa-malware-sweep.md) - 2026-08-25 · high · advisory sweep · npm, PyPI · 10 packages. 10 new GHSA CWE-506 advisories in the 24h ending 2026-08-25. Highlights: PyPI `msrcpoc@99.1.9` looks like a 99.x.x dep-confusion / Microsoft MSRC-lookalike probe; PyPI `multyproccess` is a `multiprocess` typosquat with a full-featured browser/wallet/clipboard infostealer; the 8 npm entries are boilerplate throwaway names with no per-package IOCs. - [GitHub Advisory malware sweep - 2026-08-24 batch (PyPI `envprovision` Snow Stealer + PyPI `cryptgraphy`/`mlflow-otel-instrumentor` cryptominer worm continuation of `2026-08-boto4` + npm `fund-list-filter`/`fund-portfolio` 999.9.12 dep-confusion + npm `@opap/player-kyc-widget` OPAP gambling KYC probe + npm `hydration-dim-kit`/`svelte-dim-kit` framework typosquat + npm `@sdgdfgdfhhhfd/*` mash-scope dropper + npm `conversa-sdk` 10-version hijack + npm `identitysecuretokenserv` internal-name dep-confusion)](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep.md) - 2026-08-24 · high · advisory sweep · npm, PyPI · 12 packages. 13 new GHSA CWE-506 advisories in the 24h ending 2026-08-24. Highlights: PyPI `envprovision` drops the **Snow Stealer** infostealer on Windows; `cryptgraphy`+`mlflow-otel-instrumentor` extend the `2026-08-boto4` cryptominer-worm operator with a new campaign brand; npm `@opap/player-kyc-widget` is a targeted probe against Greek gambling operator OPAP. - [GitHub Advisory malware sweep - 2026-08-23 batch (npm `@syncraft-labs/{core,react,vue}` EtherHiding blockchain-C2 dropper + 5-package `N-*-sight-web` bitbucket dropper + 4-package `*-testing-utils`/`*-testkit` jsonstorage.net pino-impersonator + 5-package `stillm4ddpocs-*` oast.fun DNS dep-confusion + `totp-utils` Minecraft JAR + Discord stealer + `create-coin` esbuild typosquat + `@usaa-grp` USAA dep-confusion + PyPI `scrambleeeer` 5th variant + PyPI `libasync` miner)](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep.md) - 2026-08-23 · high · advisory sweep · npm, PyPI · 23 packages. 20 new GHSA CWE-506 advisories in the 24h ending 2026-08-23. Highlights: `@syncraft-labs/{core,react,vue}` uses **Ethereum-blockchain dead-drop C2** (EtherHiding); five `N-*-sight-web` packages fetch mutable Bitbucket payloads; four pino-impersonators pull from `jsonstorage.net`; `totp-utils` drops a Minecraft mod JAR + steals Discord tokens. - [GitHub Advisory malware sweep - 2026-08-22 batch (PyPI `requests-crypt` = fourth `2026-08-reqcrypt` variant + PyPI `boto4` Telegram-C2 miner/worm + npm `lumen-pages-community` + `@gfe/lx-watcher` dep-confusion webhooks + `fuel-react` env exfil + `rollup-packages-node-polyfills` new JFrog-shape sibling + Postman/Okta typosquat + 3 CWE-506 no-IOC pulls)](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep.md) - 2026-08-22 · high · advisory sweep · npm, PyPI · 11 packages. 13 new GHSA CWE-506 malware advisories in the 24h ending 2026-08-22. PyPI `requests-crypt` is the **fourth** variant of the `2026-08-reqcrypt` HTTP-response `exec()` register; `boto4` is a Telegram-bot-controlled miner + LAN worm. npm side: `lumen-pages-community`/`@gfe/lx-watcher` dep-confusion beacons, `fuel-react` env exfil, and a new JFrog/Lazarus rollup-family sibling. - [GitHub Advisory malware sweep - 2026-08-21 batch (npm `coin-fees` Burp Collaborator credential recon with CI-aware dormancy + PyPI `reqcrypts` third `2026-08-reqcrypt` HTTP-response backdoor variant)](https://dependencywatch.io/incident/multi-2026-08-21-ghsa-malware-sweep.md) - 2026-08-21 · high · advisory sweep · npm, PyPI · 2 packages. Two GHSA CWE-506 advisories published in the 24h ending 2026-08-21 06:00 UTC. npm `coin-fees` postinstall infostealer exfils `~/.npmrc` tokens + CI/CD env secrets to a Burp Collaborator `oastify.com` beacon after a 30-120s dormancy delay; PyPI `reqcrypts` is a third variant of the `2026-08-reqcrypt` HTTP-response `exec()` backdoor register. - [GitHub Advisory malware sweep - 2026-08-20 batch (PyPI `libasync` cryptominer typosquat continuation of `2026-07-pyqt6darktheme` register, PyPI `rc4-secure` OpenSSF PoC, npm `express-route-engine` jsonbin.io eval-loader, `base99-85x` base-x typosquat with plaintext key exfil to `168.231.81.80`, `mc-provider` Cosmos-registry impersonator with `supersig` transitive dropper, `x6842179305` XOR-Function dropper, `ai-texts-utils`+`ai-texts` bundled obfuscator payload, dep-confusion PoC families `dolyame-*`+`fb-*`+`devplatform-*`+`digital-interview-*`+`pfp-*`+`bigops-*`, express+eslint+create-react-app typosquat cluster, blockchain-toolkit typosquats `ethereum-validator`+`polygon-toolkit-validate`)](https://dependencywatch.io/incident/multi-2026-08-20-ghsa-malware-sweep.md) - 2026-08-20 · high · advisory sweep · npm, PyPI · 60 packages. 31 GHSA CWE-506 advisories in the 24h ending 2026-08-20 06:00 UTC. Headliners: PyPI `libasync` cryptominer with Windows-registry persistence (campaign `2026-08-libasync`, continuation of `2026-07-pyqt6darktheme`), npm `express-route-engine` eval-loader that fetches JSON payloads from `jsonbin.io`, and `base99-85x` **base-x typosquat that streams caller-supplied private-key/seed material in cleartext to `168.231.81.80`**. - [Rust crates `arrayref` 0.3.10 + `internment` 0.8.7 + `append-only-vec` 0.1.9 poisoned with a build-time dropper via typosquat dependency `proc-macro1` (crates.io, 2026-08-20, 245M+ combined downloads, DPRK-overlap attribution)](https://dependencywatch.io/incident/crates-2026-08-20-arrayref-proc-macro1-build-time.md) - 2026-08-20 · critical · compromise · crates.io · 5 packages. Compromised maintainer accounts published `arrayref@0.3.10` (244M downloads), `internment@0.8.7`, and `append-only-vec@0.1.9` to crates.io. Each release added a single dependency line on typosquat crate `proc-macro1`, whose `build.rs` downloads and executes a platform-specific payload from `23.254.165.112:9089` during `cargo build`. Wiz attributes overlap to DPRK campaigns. - [GitHub Advisory malware sweep - 2026-08-19 batch (Sui `@mysten/*` typosquat continuation day 6 `sui-graphql-rpc`+`sui-gql-rpc` targeted git-config allowlist, Chinese exam-cheat surveillance suite `sysc1`+`syjoy`+`syboy`+`sysdo`, pino/jsonspack revival `chai-as-gateway`+`chaikit`+`solidity-hold`, Streak sibling typosquat `streak-key-lib`+`streak-cal-core` ELF dropper, txs SDK Caesar loader pair `txs-runner-sdk`+`txs-lib-sdk`, `@sarex-team/*` DNS exfil pair, deepface Telegram-session PyPI typosquat `deepface-weight`+`deepface-weights`, `reqcrypt` HTTP-response backdoor)](https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep.md) - 2026-08-19 · high · advisory sweep · npm, PyPI · 29 packages. 28 GHSA CWE-506 advisories in the 24h ending 2026-08-19 06:00 UTC. Headline: **Sui `@mysten/*` typosquat day 6** (`sui-graphql-rpc`, `sui-gql-rpc`) with a **targeted git-config allowlist** payload - dormant in CI, only fires for hardcoded developer identities. Also: 4-package Chinese exam-cheat surveillance, `jsonspack` pino-typosquat revival, and a PyPI deepface Telegram-session stealer. - [GitHub Advisory malware sweep - 2026-08-17 / 2026-08-18 batch (Sui blockchain `@mysten/*` typosquat days 4-5 continuation `sui-move-graphql`+`sui-move-rpc`+`sui-gql-core`+`bcs-core`+`bucket-protocol-sdk-v2`, Tinkoff BNPL dep-confusion tail `bnpl-blocks-independent-bnpl-search`, LEB128 encoding typosquat pair `leb128x`+`ulebkit`, generic CWE-506 boilerplate `blastradar`+`runtime-health`, PyPI Telegram-RAT trio `socks5901`+`infogram-bot`+`httpz-requests`)](https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep.md) - 2026-08-18 · high · advisory sweep · npm, PyPI · 13 packages. 13 GHSA CWE-506 advisories across npm + PyPI in the 24h ending 2026-08-18 06:00 UTC (extended 2026-08-19 with two late PyPI Telegram-RAT entries). Headline: **five-package Sui blockchain typosquat continuation** (`sui-move-graphql`, `sui-move-rpc`, `sui-gql-core`, `bcs-core`, `bucket-protocol-sdk-v2`) extends the `@mysten/*` typosquat register into day-4/5. Also: Tinkoff BNPL dep-confusion tail, `leb128x`+`ulebkit` LEB128 typosquat pair, generic CWE-506 pair, and a PyPI Telegram-RAT trio `socks5901`+`infogram-bot`+`httpz-requests`. - [GitHub Advisory quiet-tail sweep - 2026-08-16 / 2026-08-17 (`@ai-vertical/ai-agent` npm generic-malware + `kb-ai` PyPI OpenSSF `setup.py`-install pentest dep-confusion demo)](https://dependencywatch.io/incident/multi-2026-08-17-ghsa-quiet-tail.md) - 2026-08-17 · medium · advisory sweep · npm, PyPI · 2 packages. Two-day quiet-tail after 08-15's 22-package burst: only two new GHSA advisories. `@ai-vertical/ai-agent@1.0.0,1.0.1` (npm, GHSA-3248-8gvm-g9jv) has the generic malware boilerplate and no IOC. `kb-ai@0.1.0,0.1.1` (PyPI, GHSA-34mp-hr4q-qvh5) is an OpenSSF `PROBABLY_PENTEST` demo overriding `setup.py install` to exfil IP + username. - [GitHub Advisory npm CWE-506 sweep - 2026-08-15 batch (`@velliajs/discord` `discord.js` impersonator with hardcoded GitHub PAT + hidden `_verifyAuthorization` kill-switch, `akamai(js)-sensor` Google-Calendar invisible-Unicode C2 trio, HackerOne/Twilio `*-probe`/`*-poc` bug-bounty-canary droppers with live payloads, `depcruise-*` + `gunzip-js` `99.9.1` dependency-confusion canary, `@wololasod/tiny-id` RC4 Windows/Linux dropper, `@finaxis/common-js` Xelis miner, `*-vim` naming-canary pair, plus IP/webhook exfiltrators)](https://dependencywatch.io/incident/npm-2026-08-15-ghsa-malware-sweep.md) - 2026-08-15 · high · advisory sweep · npm · 22 packages. 22 npm CWE-506 advisories published 2026-08-15 - the day's headline is **`@velliajs/discord@1.0.3..1.0.7`**, a `discord.js` impersonator with two live hardcoded GitHub PATs, an unpinned private-repo `sysframe` dependency the operator can hot-swap, and a hidden `Client.login()` `_verifyAuthorization` allowlist kill-switch. Same-day clusters include a 3-package `akamai(js)-sensor` Google-Calendar-dead-drop trio using invisible-Unicode payloads, HackerOne/Twilio `*-probe`/`*-poc` bug-bounty-canary droppers with real credential exfil, a `depcruise-*` + `gunzip-js` `99.9.1` OpenSSF-domain-flagged canary group, `@wololasod/tiny-id` RC4 dropper, `@finaxis/common-js` Xelis miner, `adxaa` WordPress account-takeover, and a matching `*-vim` naming-canary pair. - [GitHub Advisory npm CWE-506 sweep - 2026-08-14 batch (~27 packages: `jchunt.top` telemetry-canary day-2 `xrblocks-mcp`, `preinstall-hook-webhook-callback-demo` webhook.site demo, `@secauditb20y/sec-test-r3b` self-labeled sec-test POC, `webautomation_js` + `@ferudionz/*` obfuscator.io RC4 runtime exfil trio, `@guangnao/agent-proxy` Claude/Codex credential monetizer to `hub.client-llm.com`, `@lodash-js/lodash-js` Xelis miner, `@divineubg/divine` ntfy.sh EventSource C2, `@demopack/www` iOS iframe exploit injector, `@ghost_debugger/nanocache` hidden Windows binary launcher, `datefmt-simple-utils` reverse shell to `8.135.48.40:4444`, `registrynpmjs.to` typosquat cluster (`@polymarkets/clob-client-v2`, `@devmikets/hyperliquid-sdk`), Brazilian `alelo-*` dep-confusion cluster to `209.99.185.109`, plus `@peptideventure/*`, `@mexc/shared-utils`, `sui-gql-lite`, `bcs-mini`)](https://dependencywatch.io/incident/npm-2026-08-14-ghsa-malware-sweep.md) - 2026-08-14 · high · advisory sweep · npm · 26 packages. ~27 npm CWE-506 advisories published 2026-08-14 (initial 4 clusters backfilled 08-15 with 8 more). Headliners: `@guangnao/agent-proxy` Claude/Codex credential monetiser to `hub.client-llm.com`, `@lodash-js/lodash-js` Xelis miner, `@divineubg/divine` ntfy.sh EventSource C2, `registrynpmjs.to` typosquat pair (`@polymarkets/clob-client-v2`, `@devmikets/hyperliquid-sdk`), Brazilian `alelo-*` dep-confusion cluster to `209.99.185.109`, `datefmt-simple-utils` reverse shell to `8.135.48.40:4444`, `@ghost_debugger/nanocache` Windows binary launcher. - [GitHub Advisory npm CWE-506 sweep - 2026-08-13 batch (`ltidisafe` GCS dep-confusion dropper ring `check-audit`+`cspell-esm`+`eslint-publish-release`+`in-install`+`knip-bun`+`resolve-audit`+`napi-raw`, `31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit `vexium-kit`+`ventra-kit`+`velora-kit`+`vortex-kit`+`copytrade-core`+`prediction-trader`, `@hzero-front-ui/*` internal-scope dep-confusion 5-package cluster with `callback.m0chan.co.uk` DNS+HTTPS beacon, `@khaznatech/*` webhook.site preinstall exfil 3-pack, `jchunt.top` telemetry-canary series `wct-st`+`tizen-webdriver-cli`, `8.135.48.40:4444` reverse-shell date-fmt masquerade pair `datefmt-util-helper`+`date-fmt-helper-xz`, `notafollower` AWS IMDSv2 credential theft, `bs58-15` base58 typosquat via `base65-15x` transitive, `@solana-js/web3` Windows PowerShell + `files.catbox.moe` RCE, `postcss-initialize-plugin` Ethereum-RPC-C2 continuation, `mutex-forge` Telegram+Slack+Ethereum-Sepolia RAT, `chai-as-reformed`+`process-live-log`+`external-process-live-log`+`minimalistic-assert-plus` Function-constructor R-shell family, `node-config-svg-contract` eval-from-URL, `nc-verify-127942`+`@jacksher/install-exec-poc` OAST recon POCs, `cilm-ui-commons` pipedream.net preinstall, ~10 boilerplate CWE-506)](https://dependencywatch.io/incident/npm-2026-08-13-ghsa-malware-sweep.md) - 2026-08-13 · high · advisory sweep · npm · 46 packages. ~50 npm CWE-506 advisories published 2026-08-13. Headline: **`ltidisafe` GCS dep-confusion dropper ring** (7+ hollow-shell packages at v99.9.1 pinning `ltidisafe` as an `https://ltidi.storage.googleapis.com/depenconf/` tarball to bypass npm registry review); **`31.97.137.157:45000` bare-IP Chromium-DPAPI stealer kit family** (`vexium-kit`, `ventra-kit`, `velora-kit`, `vortex-kit`, `copytrade-core`, `prediction-trader` - all fetch `/icons/108|116` and `eval()` a `credits` field with `@primno/dpapi`+`better-sqlite3`+`node-machine-id` bundled for browser-cred theft); and a **`@hzero-front-ui/*` 5-package internal-scope dep-confusion cluster** beaconing to `callback.m0chan.co.uk`. - [GitHub Advisory npm CWE-506 sweep - 2026-08-12 batch (Web3 typosquat webhook.site ring day-2 `permit2`+`camelot-ammv2-*`+`boring-vault`+`augustdigital-sdk`+`upshift-*`, Ethereum-RPC-C2 `envpack-conf`+`tailwind-form-templates` XOR-encrypted second-stage on blockchain, `svelte-kit-vim`+`kit-map-vim` map-streak-kit day-4 continuation, `sui-gql`+`bcs-compact` Sui `@mysten/*` typosquat continuation, ~50-package `@years17/18/19/20/*` n8n-nodes-utils-helper red-team SSH-backdoor mass drop, `internallib_v756`/`v392` bare `/dev/tcp/10.0.74.63/4444` reverse shell, `mcp-util-helpers` webhook.site R-shell channel, `passkeys-react` Burp Collaborator OAST recon, `bb-twl-k7x2` Twilio-internal dep-confusion, `@telekom-ods/react-ui-kit` Deutsche Telekom internal-scope, `verify-cli`+`@assetshop/verify-cli` OAST recon pair, `dakumangalsingh` Java-Robot RAT with jpackage wrapper, boilerplate CWE-506 mass npm flood ~100 packages)](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep.md) - 2026-08-12 · high · advisory sweep · npm · 159 packages. ~160 npm CWE-506 advisories published 2026-08-12. Headline: **Web3 typosquat webhook.site ring day-2** (`permit2`, `camelot-ammv2-core/periphery`, `boring-vault`, `augustdigital-sdk`, `upshift-finance/config`) with identical env/wallet-keystore exfil TTP as the [08-11 OpenZeppelin/Aerodrome ring](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep); **Ethereum-RPC-C2 pair** (`envpack-conf`, `tailwind-form-templates`) fetching XOR-encrypted second-stage from blockchain via wallet `0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a`; and a **~50-package `@years17/18/19/20/*` red-team n8n mass drop** installing pwn@kali SSH backdoors. - [GitHub Advisory npm CWE-506 sweep - 2026-08-11 batch (webhook.site Web3 typosquat credential-theft ring `@openzeppelin-4/5/contracts`+`@aerodrome-finance/contracts`+`@aerodrome-finance/slipstream`+`ethereum-vault-connector`, `safe-local-env-loader` env-local RAT sibling, `newtun` unencrypted-WebSocket PTY RAT with self-update, `svelte-vim-kit`+`kit-vim-map` map-streak-kit family continuation, `@nzeros/codebreak` Go ELF disguised as C solver, `base65-*` base-x typosquat cluster with 123KB obfuscated payload + `bs58-*` boilerplate siblings, coordinated `oastify.com`/`sslip.io`/webhook OAST dep-confusion recon beacons)](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep.md) - 2026-08-11 · high · advisory sweep · npm · 38 packages. 38 npm CWE-506 advisories published 2026-08-11. Headline: **five-package Web3 typosquat ring** (`@openzeppelin-4/contracts`, `@openzeppelin-5/contracts`, `@aerodrome-finance/contracts`, `@aerodrome-finance/slipstream`, `ethereum-vault-connector`) sharing the same `webhook.site` credential-exfil TTP with 60-240s detached-process delay + sandbox evasion, `safe-local-env-loader` continuing the [2026-08-10 `env-local`](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep) Windows RAT, and `newtun` shipping a PTY reverse shell with self-update. - [GitHub Advisory PyPI CWE-506 sweep - 2026-08-11 batch (`joule-sbx-poc`+`joule-btp-extension` 2026-08-joule-btp-extension localhost-exfil + reverse-shell PROBABLY_PENTEST pair, `telebot-pro` 2026-08-telebot-pro Telegram-session hidden-thread infostealer, `euler-sdk`+`morpho-sdk` GENERIC-standard-pypi-install-pentest setup.py install-hook IP+username exfil, `dlmm-sdk`+`dlmm` 2026-08-dlmm MALICIOUS env-var + credential + crypto wallet-directory enumeration)](https://dependencywatch.io/incident/pypi-2026-08-11-ghsa-malware-sweep.md) - 2026-08-11 · high · advisory sweep · PyPI · 7 packages. 7 PyPI CWE-506 advisories published 2026-08-11 across four named campaigns: **2026-08-telebot-pro** starts a hidden exfiltration thread that lifts **Telegram session files, pictures, and connected WiFi network info**; **2026-08-dlmm** exfiltrates env vars + credentials + cryptocurrency wallet directory listings on import; **2026-08-joule-btp-extension** + `euler-sdk`/`morpho-sdk` are PROBABLY_PENTEST setup.py install-hook recon packages targeting DeFi vendor namespaces. - [GitHub Advisory npm CWE-506 sweep - 2026-08-10 batch (`iconova-react` + `postcss-initial-provider` on-chain Ethereum RPC dead-drop C2 loader pair, `svelte-kit-streak`+`kit-map-streak` Linux implant continuation of the map-streak-kit family, `@rblxts/services` catbox.moe Windows RAT sibling of last week's `@rbx-ts/services`, `@kuperka/chainguard-sdk` browser-form + wallet exfil, `xerohub-discord-voice` Discord-token stealer, `env-local` Windows persistent screen-capture + remote control, `hex-encode-utils` Cloudflare-Workers AES-GCM Python-payload loader, `cryptostock`/`tokocrytodev` Infura wallet-drainer, `simple-date-formatter-new-9/10` bash reverse shell to 124.221.154.135:4444, `polymarket-stake-mathss` log-taker.store loader, `chai-tracker` chai-spies impersonator with `dbconnectify` C2, `@noobaihome/amis-*-area-widget` Baidu-internal dep-confusion SSRF probe, and multi-vendor SQLite/postcss/commonjs/eth-library typosquat clusters)](https://dependencywatch.io/incident/npm-2026-08-10-ghsa-malware-sweep.md) - 2026-08-10 · high · advisory sweep · npm · 42 packages. 46 npm CWE-506 advisories published 2026-08-10. Standouts: `iconova-react`+`postcss-initial-provider` use **Ethereum RPC on-chain dead-drop C2** to fetch stage-2 IP addresses (same EtherHiding technique as the CHAINDROP keyv/cacheable worm); `svelte-kit-streak`+`kit-map-streak` continue the `map-streak-kit` Linux-implant family; `env-local` installs a Windows registry-persisted screen-capture + remote-control implant impersonating dotenv. - [GitHub Advisory PyPI CWE-506 sweep - 2026-08-09..2026-08-11 batch (`neutrl-core`+`neutrl-contracts`+`plp-contract` credential-stealing dep-hidden campaign 2026-08-neutrl-core, `kotanku`+`kotoraka`+`btcflx`+`btcflip` Telegram-bot wallet-file exfiltrator quartet 2026-08-kotanku campaign, `pytablute` 2025-11-spellcheckers multi-stage RCE + polling C2, `chaintest` DPRK Contagious-Interview-adjacent browser+wallet+clipboard+SSH-key infostealer, `bigtime` open()-hook file-write exfiltrator 2026-08-bigtime campaign, `cubesat-upstream-driver` env-var reconnaissance dep-confusion PROBABLY_PENTEST)](https://dependencywatch.io/incident/pypi-2026-08-10-ghsa-malware-sweep.md) - 2026-08-10 · high · advisory sweep · PyPI · 11 packages. 11 PyPI CWE-506 advisories published 2026-08-09..2026-08-11 across four named campaigns: **2026-08-neutrl-core** hides credential theft in an intentional malicious dependency (fake backdated GitHub history); **2026-08-kotanku** ships four Telegram-bot cryptocurrency-wallet-file exfiltrators (`kotanku`, `kotoraka`, `btcflx`, `btcflip`); **2025-11-spellcheckers** multi-stage RCE lands as `pytablute`; **`chaintest`** is a DPRK "Contagious Interview"-adjacent full-spectrum stealer. - [GitHub Advisory npm CWE-506 sweep - 36-package 2026-08-08 batch (`sme-rko-finance-front-*` 30-package Tinkoff/T-Bank RKO SME dep-confusion cluster running WEL1DROPPER-style cross-platform Cloudflare-Workers dropper + `@coralxyz/anchor` Solana Anchor typosquat with PowerShell zip drop + `titan-exchange-shared-permissions@99.9.9` dep-confusion recon + `@rbx-ts/services` Roblox-TS typosquat catbox.moe RAT + `map-streak-kit` Linux implant with systemd persistence + `localization-fixer`/`modern-localization` jsonbin.io mutable-payload loader pair)](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep.md) - 2026-08-08 · high · advisory sweep · npm · 47 packages. 36 npm CWE-506 advisories 2026-08-08: 30-package `sme-rko-finance-front-*` Tinkoff/T-Bank RKO dep-confusion cluster (v35.8.1, WEL1DROPPER-style Cloudflare-Workers dropper) plus outliers `@coralxyz/anchor` Solana typosquat, `titan-exchange-shared-permissions@99.9.9` recon, `@rbx-ts/services`, `map-streak-kit` Linux implant, and a `localization-fixer`+`modern-localization` jsonbin.io loader pair. - [GitHub Advisory PyPI CWE-506 sweep - 2026-08-08 batch (`riakcs` Basho Riak-CS Python client typosquat with setup.py install-time host reconnaissance)](https://dependencywatch.io/incident/pypi-2026-08-08-ghsa-malware-sweep.md) - 2026-08-08 · high · advisory sweep · PyPI · 1 package. GHSA published one PyPI CWE-506 advisory dated 2026-08-08: `riakcs` (v0.0.1 and v0.5.0) - a typosquat/naming-collision on Basho Riak-CS Python client. Overrides `setup.py install` to silently exfiltrate the installer host IP + username at install time. OpenSSF MAL-2026-13665, discovery credit `kam193`. - [GitHub Advisory npm CWE-506 sweep - 33+ package 2026-08-07 batch (`remote-claude-daemon` full-desktop RAT via WebSocket relay + baileys-clone WhatsApp bot cluster + `@cats-cdf/*` OAST recon pair + `internallib_v514` internal LAN reverse-shell + `wormgpt-cli` LLM-branded RAT + `@united-airlines-org/atmos-design-system` dep-confusion + `@ks-video/kwai-player-web` telemetry beacon + `@avi892nash/aegis-grid-runner` Juspay-leaked internal RCE tool + `@junyoung-kim/reins` PTY-reverse-shell with systemd persistence + `noviembrenacional.com` WordPress-CSRF nuke pair + long tail)](https://dependencywatch.io/incident/npm-2026-08-07-ghsa-malware-sweep.md) - 2026-08-07 · high · advisory sweep · npm · 32 packages. GHSA published 33+ npm CWE-506 advisories dated 2026-08-07 spanning several clusters: `remote-claude-daemon` (Claude Code full-desktop RAT with screen + mic capture via WebSocket relay, 20 versions), a 4-package baileys-clone WhatsApp bot cluster (`@prototypevip/baileys`, `diezyclutch-baileys`, `ynastore-baileys`, and more), `@cats-cdf/*` OAST dep-confusion recon, `internallib_v514` reverse-shell to hardcoded `10.0.70.90` (continuation of `internallib_v` campaign), `wormgpt-cli` (LLM-branded RAT with clipboard theft), `@united-airlines-org/atmos-design-system` dep-confusion, `@ks-video/kwai-player-web` telemetry beacon, `@avi892nash/aegis-grid-runner` (leaked-internal-Juspay RCE tool), `@junyoung-kim/reins` (PTY reverse-shell with systemd persistence), and `xxdxax`+`xdaxx` (targeted WordPress CSRF/account-nuke against `noviembrenacional.com`). - [GitHub Advisory PyPI CWE-506 sweep - 10-package 2026-08-07 batch (`2026-08-alphalend-layouts` Sui keystore-stealer pair with PTH persistence + `2026-08-flasq` typosquat wave: `pydanticc`+`flasq`+`idnna`+`fastapii`+`fast-hashes`+`speed-hashes` crypto-wallet stealers + `cdktn-provider-azurerm` cdktf HashiCorp jsii-chain typosquat + `atlas-internal` dep-confusion recon)](https://dependencywatch.io/incident/pypi-2026-08-07-ghsa-malware-sweep.md) - 2026-08-07 · high · advisory sweep · PyPI · 10 packages. GHSA published 10 PyPI CWE-506 advisories dated 2026-08-07 across three clusters: `2026-08-alphalend-layouts` Sui keystore-stealer pair with PTH file persistence (`alphalend-layouts`, `alphalend-abi`); `2026-08-flasq` typosquat wave dropping crypto-wallet stealers (`pydanticc`, `flasq`, `idnna`, `fastapii`, `fast-hashes`, `speed-hashes`); and singletons `cdktn-provider-azurerm` (HashiCorp cdktf typosquat with jsii import-time chain) and `atlas-internal` (dep-confusion recon). - [GitHub Advisory npm CWE-506 sweep - 50+ package 2026-08-06 batch (Sui-blockchain `sui-migration-audit-*` + `move-bcs-codec` cluster, `@activepieces/piece-*` typosquat sweep, `@ccfly/setup-*` platform-binary quartet, `@addai/*` cluster, `claude-remote-agent` RAT, `diezyyasha-baileys` + `alipclutch-baileys` WhatsApp cluster, `@holocronlab/botruntime-runtime` bot-framework masquerade, `helmet-pro` + `agenttunnels` + `agenthub-multiagent-mcp` + `typst-resume-cli` misc)](https://dependencywatch.io/incident/npm-2026-08-06-ghsa-malware-sweep.md) - 2026-08-06 · high · advisory sweep · npm · 58 packages. GHSA published 50+ npm CWE-506 advisories dated 2026-08-06 spanning several clusters: Sui blockchain tooling (`sui-migration-audit-cli`, `sui-graphql-client`, `sui-migration-audit-rules`, `move-bcs-codec`), an `@activepieces/piece-*` typosquat sweep (`piece-google-contacts`, `piece-google-bigquery`, `piece-google-forms`, `piece-base44`), a `@ccfly/setup-*` platform-binary quartet (`darwin-arm64`, `darwin-x64`, `linux-arm64`, `linux-x64`), an `@addai/*` cluster (`ainode`, `node`, `entity-runtime`), `claude-remote-agent` RAT, WhatsApp `diezyyasha-baileys` + `alipclutch-baileys` sibling clones, `@holocronlab/botruntime-runtime` bot framework masquerade, and a long tail of enterprise-scope dep-confusion probes. - [GitHub Advisory PyPI CWE-506 sweep - 3-package 2026-08-06 batch (`xAyOuB-XcTxTeaM` Garena Free Fire spam-cannon botnet + `uncrypt` browser infostealer + `decapod-common` pentest)](https://dependencywatch.io/incident/pypi-2026-08-06-ghsa-malware-sweep.md) - 2026-08-06 · high · advisory sweep · PyPI · 3 packages. GHSA published 3 PyPI CWE-506 advisories dated 2026-08-06: `xAyOuB-XcTxTeaM` (Garena Free Fire spam-cannon opening a Flask server on 0.0.0.0:50019 with ~20 hardcoded account credentials for gaming-platform abuse), `uncrypt` (embedded-executable browser-data infostealer with sandbox detection, campaign `2026-08-uncrypt`), and `decapod-common` (pentest host-recon under `GENERIC-standard-pypi-install-pentest`). - [GitHub Advisory npm CWE-506 sweep - 40+ package 2026-08-05 batch (massive Tinkoff Bank / dolyame BNPL / bnpl-blocks / tramvai / statist enterprise-scope dep-confusion burst, plus `clawtrl-wallet` crypto stealer + `sextant-cli-darwin-arm64` platform-binary + `@lizhao1/memorax-code-internal` + `@cliphijack/santaclaude` Claude-themed clipboard hijack + `llm-interceptor` + `multi-acct` + `kepler`)](https://dependencywatch.io/incident/npm-2026-08-05-ghsa-malware-sweep.md) - 2026-08-05 · high · advisory sweep · npm · 42 packages. GHSA published 40+ npm CWE-506 advisories dated 2026-08-05 dominated by a massive **Tinkoff Bank (Russian bank) enterprise-scope dep-confusion burst**: `tinkoff-*`, `dolyame-boxy-*` (Tinkoff BNPL), `bnpl-blocks-atom-*`, `tramvai-*` (Tinkoff's open-source framework), `bigops-*`, `sme.rko.*` internal namespaces. Also `clawtrl-wallet` (crypto wallet stealer), `@cliphijack/santaclaude` (Claude-themed clipboard hijack), `sextant-cli-darwin-arm64`, `@lizhao1/memorax-code-internal`, `llm-interceptor`, `multi-acct`, `kepler`, `express-dever`, `svelte-mapped-metrics`, `streak-math-calc`, `streak-calc-metrics`, `svelte-mapping-core`, `eslint-plugin-vitest-ts`, `tailwindcss-scrollbar-hide`, `express-rate-controller`, `@stageflight-testbed/a`, `@workoscalif/sudoku`, `trapp-check-logs`, `sme-foundation-frame-manager`. - [GitHub Advisory PyPI CWE-506 sweep - 4-package 2026-08-05 batch (`2026-08-bip39-py` crypto-wallet infostealer campaign: `solana-sniper-bot` + `eth-account-wallet` + `mnemonic-py` + `defi-sdk-py`)](https://dependencywatch.io/incident/pypi-2026-08-05-ghsa-malware-sweep.md) - 2026-08-05 · high · advisory sweep · PyPI · 4 packages. GHSA published 4 PyPI CWE-506 advisories dated 2026-08-05, all attributed to campaign `2026-08-bip39-py`: `solana-sniper-bot`, `eth-account-wallet`, `mnemonic-py`, and `defi-sdk-py`. All four use setup.py install-command override to exfiltrate env vars, browser data, crypto wallet files, SSH keys, and configuration files. Cross-chain crypto-wallet targeting (Solana + Ethereum + generic mnemonic phrases + DeFi). - [keyv / cacheable family hijacked in Shai-Hulud "Here We Go Again" worm](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable.md) - 2026-08-04 · critical · compromise · npm · 443 packages. On 2026-08-04 a compromised maintainer account pushed a `preinstall` credential stealer into the `keyv` / `cacheable` family and the worm spread via stolen npm tokens across ~2B monthly installs. Releases were cut from `main`, so npm signed them with valid provenance. Verified count as of the Wiz IOC feed: **443 npm packages across 2,235 versions**; SafeDep's registry-backed telemetry puts the total at 1,684 versions across 420 names tied to nine orgs. - [GitHub Advisory npm CWE-506 sweep - 1-package 2026-08-04 batch (`internallib_v688` third-day continuation of the `internallib_v` sequential dep-confusion enumeration campaign)](https://dependencywatch.io/incident/npm-2026-08-04-ghsa-malware-sweep.md) - 2026-08-04 · high · advisory sweep · npm · 1 package. GHSA published 1 npm CWE-506 advisory dated 2026-08-04: `internallib_v688` (`>= 0`) - a third-day continuation of the `internallib_v` sequential dep-confusion enumeration campaign that dropped `internallib_v524` and `internallib_v568` on 2026-08-03. The `internallib_` prefix explicitly probes for internal-package name collisions on any org that publishes `internallib_*` internal libraries. - [GitHub Advisory PyPI CWE-506 sweep - 4-package 2026-08-04 batch (Bitcoin hardware-wallet infostealer cluster `2026-08-coldcard-helpers` + `2026-08-psbt-utils`, plus 1 pentest kit)](https://dependencywatch.io/incident/pypi-2026-08-04-ghsa-malware-sweep.md) - 2026-08-04 · high · advisory sweep · PyPI · 4 packages. GHSA published 4 PyPI CWE-506 advisories dated 2026-08-04: three Bitcoin hardware-wallet infostealers - `coldcard-helpers`, `psbt-helpers`, `psbt-utils` (Coldcard + PSBT Partially Signed Bitcoin Transaction targeting under campaigns `2026-08-coldcard-helpers` / `2026-08-psbt-utils`) - and a fourth pentest-flagged host-recon kit `launchdarkly-ai-server-sdk`. - [GitHub Advisory npm CWE-506 sweep - 18-package 2026-08-03 batch (`@types-beta/sdk@0.1.0-0.1.3` `@types`-namespace impersonation with Windows `nanocache.exe` WinHTTP-WebSocket RAT, 5-package `beaver-ui-*` component-library burst, `internallib_v524`/`v568` sequential dep-confusion continuation, `simple-date-formatter-new-1`/`-util-5` OpenSSF-PA C2 + command-execution pair, `tailwind-anim` Tailwind-ecosystem typosquat second-day companion, `@custombots/custombot@1.0.0` OpenSSF-PA malicious-command scoped RAT, and 5-package internal-tooling dep-confusion singleton burst)](https://dependencywatch.io/incident/npm-2026-08-03-ghsa-malware-sweep.md) - 2026-08-03 · high · advisory sweep · npm · 17 packages. GHSA published 18 npm CWE-506 advisories dated 2026-08-03. Most severe: `@types-beta/sdk@0.1.0-0.1.3` - a `@types`-namespace impersonation embedding a Windows `nanocache.exe` WinHTTP WebSocket RAT. Batch also includes a 5-package `beaver-ui-*` dep-confusion burst, `internallib_v524/v568` continuation, `simple-date-formatter-*` OpenSSF-PA C2+cmd pair, `tailwind-anim`, and 5 more. - [GitHub Advisory PyPI CWE-506 sweep - 1-package 2026-08-03 batch (`instalogin1234@0.0.1` Instagram credential-harvester with Discord exfil, campaign `2026-08-instalogin1234`)](https://dependencywatch.io/incident/pypi-2026-08-03-ghsa-malware-sweep.md) - 2026-08-03 · high · advisory sweep · PyPI · 1 package. GHSA published 1 PyPI CWE-506 advisory dated 2026-08-03: `instalogin1234@0.0.1` - masquerades as an Instagram CLI tool, captures user login credentials, exfiltrates them to a Discord channel, and opens the legitimate Instagram website in the browser to hide the theft. Attributed to campaign `2026-08-instalogin1234` in the OpenSSF malicious-packages repository. - [GitHub Advisory npm CWE-506 sweep - 8-package 2026-08-02 batch (`houzidawang806/807/808` sequential-namespace trio, `simple-date-formatter-util`/`-1`/`-2` date-util trio, `tailwindcss-anim` Tailwind-ecosystem typosquat, `list-issue-predecessor-dependencies-block@99.0.0` OpenSSF-PA C2-domain communicator with dep-confusion inflated pin)](https://dependencywatch.io/incident/npm-2026-08-02-ghsa-malware-sweep.md) - 2026-08-02 · high · advisory sweep · npm · 8 packages. GHSA published 8 npm CWE-506 advisories dated 2026-08-02 - a `houzidawang806/807/808` sequential-namespace trio, a `simple-date-formatter-util` + `-1` + `-2` date-utility trio, `tailwindcss-anim` under the Tailwind CSS ecosystem name shape, and `list-issue-predecessor-dependencies-block@99.0.0` flagged by OpenSSF Package Analysis for both malicious-domain communication AND malicious-command execution with the extreme-inflated dep-confusion pin (`99.0.0`). - [GitHub Advisory PyPI CWE-506 sweep - 2-package 2026-08-02 batch (`trongriden@0.0.1` Tron/TRX cryptocurrency private-key exfiltration under the long-running `2025-04-tronix` campaign, `wacve-utils@1.0.7` Linux + Android/Termux encrypted infostealer with Telegram exfil)](https://dependencywatch.io/incident/pypi-2026-08-02-ghsa-malware-sweep.md) - 2026-08-02 · high · advisory sweep · PyPI · 2 packages. GHSA published 2 PyPI CWE-506 advisories dated 2026-08-02: `trongriden@0.0.1` - Tron/TRX cryptocurrency private-key exfiltration marked as part of the long-running `2025-04-tronix` campaign - and `wacve-utils@1.0.7`, an encrypted infostealer targeting Linux and Android execution under Termux with **file system / browser / SMS collection routed to a Telegram channel** and remote-script download for dynamic payload updates. - [GitHub Advisory npm CWE-506 sweep - 10-package 2026-08-01 batch (`test-dev-*` 8-package sequential-namespace burst, `@moxfive-llc/common` scoped RAT, `pp-react-worldready` OpenSSF-PA C2 domain communicator)](https://dependencywatch.io/incident/npm-2026-08-01-ghsa-malware-sweep.md) - 2026-08-01 · high · advisory sweep · npm · 10 packages. GHSA published 10 npm CWE-506 advisories dated 2026-08-01 - an 8-package `test-dev-*` sequential-namespace burst (`test-dev-boot`, `-host`, `-watch`, `-sync`, `-dispatch`, `-exec`, `-store`, `-link`), a `@moxfive-llc/common` scoped RAT publish, and `pp-react-worldready@1.0.0` flagged by OpenSSF Package Analysis for communicating with a domain associated with malicious activity. - [GitHub Advisory PyPI CWE-506 sweep - 7-package 2026-08-01 batch (`asdk-plugin-*` 3-package dep-confusion trio at `0.0.1`/`9999.0.0`, `walmart-genai-trace` dep-confusion probe, `telerape` PTH-file reverse-shell, `nvtorch-oot-nightly`/`trtllm-subdir-test` NVIDIA-adjacent dep-confusion probe pair at `99999.0.0`/`99999.0.1`)](https://dependencywatch.io/incident/pypi-2026-08-01-ghsa-malware-sweep.md) - 2026-08-01 · high · advisory sweep · PyPI · 7 packages. GHSA published 7 PyPI CWE-506 advisories 2026-08-01: `asdk-plugin-alphagen/-legacy/-ai-platform` (dep-confusion trio at `0.0.1` + `9999.0.0`), `walmart-genai-trace` (Walmart internal GenAI namespace probe), `telerape` (**PTH-file reverse-shell persistence**), and `nvtorch-oot-nightly` + `trtllm-subdir-test` (NVIDIA-adjacent dep-confusion probe pair at `99999.0.0`/`99999.0.1` targeting `torch-oot-nightly` and TensorRT-LLM subdir internal namespaces). ## 2026-07 - [GitHub Advisory npm CWE-506 sweep - 91-package 2026-07-30/07-31 batch (`@peptide-packets` biotech scope pair, socket.io/mongoose/passport typosquat burst, ethers.js/rlp/fs-extra impersonator kit, `nano-perf` postinstall daemon C2, late-07-31 MCP-namespace burst, `@0xlr` dep-confusion PoC scope, `@spending-behavior-ui`/`@finance-ui`/`@mplay-*`/`@sof-assistant-*` enterprise dep-confusion sweep, `rollup-plugin-polyfill-hold`/`-helper` pair, `paraglide-js@1.0.1` takeover-style drop)](https://dependencywatch.io/incident/npm-2026-07-31-ghsa-malware-sweep.md) - 2026-07-31 · high · advisory sweep · npm · 92 packages. GHSA published 91 npm CWE-506 advisories 2026-07-30–07-31: existing 25-pkg batch (`@peptide-packets`, socket.io/mongoose/passport typos, ethers/rlp/fs-extra, `nano-perf` C2) plus a late-07-31 66-pkg wave - MCP-namespace burst (13), `@0xlr` dep-confusion PoC scope (10), enterprise internal-scope dep-confusion sweep (15 scoped pkgs), broad unscoped typosquats (25), `rollup-plugin-polyfill-hold`/`-helper` pair, `paraglide-js@1.0.1` takeover. - [GitHub Advisory PyPI CWE-506 sweep - 14-package 2026-07-30/07-31 batch (`ml-*-shared` env-var exfil, `ai-perf-toolkit` + `mcp-search-server` cryptominer pair, `phabricator-client@99.x` dep-confusion, plus late-07-31 `2026-07-cognikit` DPRK Contagious Interview cluster and `reguestsc` salatstealer)](https://dependencywatch.io/incident/pypi-2026-07-31-ghsa-malware-sweep.md) - 2026-07-31 · high · advisory sweep · PyPI · 14 packages. GHSA published 14 PyPI CWE-506 advisories 2026-07-30–07-31: `ml-*-shared` env-var exfil kit (4 pkgs), `ai-perf-toolkit` + `mcp-search-server` cryptominer pair, `phabricator-client@99.x` dep-confusion, plus late-07-31 DPRK Contagious Interview `2026-07-cognikit` cluster (`aiprepkit`, `catalogai`, `cognikit`, `aiassistcore`, `aichannel`, `ailaunchkit`) and `reguestsc` salatstealer typosquat. - [GitHub Advisory npm CWE-506 sweep - 28-package late 2026-07-29 backfill (`@ai-plus`/`@ai-agent-node` 5-pkg AI-agent SDK cluster, 5-pkg Polymarket / prediction-market impersonator kit, `@peptide-unit` scope pair, 6-pkg Alibaba-adjacent `lzd-*`/`uniapi-*`/`aone-cloud-cli`/`colder-cli`/`lwp-web-client`/`def-open-client` scope, `@zannstore/baileys` 17-version WhatsApp SDK typosquat, misc single-package RATs including `eslintcmd` ESLint typosquat)](https://dependencywatch.io/incident/npm-2026-07-30-ghsa-malware-sweep.md) - 2026-07-30 · high · advisory sweep · npm · 28 packages. GitHub Advisory Database published a further 28 npm CWE-506 advisories dated 2026-07-29 after the prior day's ingest - clusters: `@ai-plus`/`@ai-agent-node` 5-pkg AI-agent SDK scopes, 5-pkg Polymarket / prediction-market impersonator kit (`polymarket-risk-manager`, `poly-kelly`, `ts-precision`, `ts-bn-proto`, `stake-math`), `@peptide-unit` pair, 6-pkg Alibaba-adjacent scope, `@zannstore/baileys` 17-version WhatsApp SDK typosquat. - [GitHub Advisory npm CWE-506 sweep - 60-package 2026-07-28 → 2026-07-29 backfill (9-package `@wagni_bot/*` Telegram credential-stealer scope, 6-package `2.1.6` postinstall SSH-key + file harvester cluster, 4-package `streak-*` Windows PE binary drop, 3-package `aone-*` embedded-malware trio, `xerohub-discord-voice` Discord-token stealer pair, generic-name C2 domain communicator kit, `@joyfill/*` prerelease pair, misc single-package RATs and typosquats)](https://dependencywatch.io/incident/npm-2026-07-29-ghsa-malware-sweep.md) - 2026-07-29 · high · advisory sweep · npm · 65 packages. GitHub Advisory Database published 6 new npm CWE-506 advisories on 2026-07-29 plus a ~55-package 2026-07-28 backfill. Clusters: `@wagni_bot/*` 9-pkg Telegram stealer, `2.1.6` SSH-key harvester (`app-*-layer`, `api-*-sdk`), `streak-*` Windows-PE dropper, `aone-*` all-versions, `xerohub-discord-voice` token stealer, generic-name C2 kit. - [GitHub Advisory npm CWE-506 mega-sweep - 54-package sample from the 2026-07-27 → 2026-07-28 batch (8-package Ethereum-tooling `curl|bash` typosquat cluster, chalk / express / prettier / prisma / dotenv / chai-as-promised typosquat pairs, "helper/utils/tool/pack" credential+wallet-stealer family, 13-package dep-confusion cluster with `999.x` / `19999.x` / `99.99.99` version-inflation, Shai-Hulud-style preinstall Bun stealer resurgence, `@vaultflow/*` 2026-07-28 pair, `claude-code-base-action` Anthropic typosquat)](https://dependencywatch.io/incident/npm-2026-07-28-ghsa-malware-sweep.md) - 2026-07-28 · high · advisory sweep · npm · 54 packages. GitHub Advisory Database published a mega-batch of **250+ new npm CWE-506 malware advisories on 2026-07-27** (spanning 12+ paginated result pages), plus 2 more on 2026-07-28 (`@vaultflow/create-flow`, `@vaultflow/update-flow`). This module catalogues 54 non-`@antv` non-previously-tracked packages from the batch. Notable clusters: 8-package Ethereum-tooling `curl|bash` operator (`web3-core-js`, `truffle-js`, `truffle-helper`, `solc-helper`, `hardhat-core`, `ethers-common`, `ethers-io`, `cdp-core`), typosquat pairs (`chalk-*`, `exxpress-*`, `prettier-lint-lenz`, `prisma-callback`, `env-threads`), dep-confusion with inflated version numbers (`999.x`, `19999.x`, `99.99.99`), and Shai-Hulud-style preinstall Bun credential stealers on `mcp-echarts`, `mcp-mermaid`, `ai-figure`, `gantt-for-react`, `amapcn`, `boring-avatars-vanilla`, `jest-canvas-mock`, `@cap-js/openapi`. - [GitHub Advisory PyPI CWE-506 sweep - 7-package 2026-07-28 batch (`karpatkit`/`karpatkey` dep-confusion pair against Karpatkey DAO tooling, `dev-helper-bg` + `cfgzen` infostealer siblings, `mrmustard` Xanadu-quantum-lib typosquat, `vtranalytic` Telegram RAT, `govapkg` fake-Go-doc-client with systemd persistence)](https://dependencywatch.io/incident/pypi-2026-07-28-ghsa-malware-sweep.md) - 2026-07-28 · high · advisory sweep · PyPI · 7 packages. GHSA published 7 new PyPI CWE-506 advisories on 2026-07-28: `karpatkit`/`karpatkey` Karpatkey DAO dep-confusion pair, `dev-helper-bg` + `cfgzen` infostealer siblings, `mrmustard@0.7.4` Xanadu typosquat, `vtranalytic@9.0.1` Telegram RAT, `govapkg@0.1.0` fake Go doc client with systemd persistence. - [GitHub Advisory npm CWE-506 sweep - 47-package overnight batch (8-package `thirdweb` / `rainbowkit` crypto-wallet typosquat cluster, 6-package baileys/WhatsApp-scraper `fazz*` + `@vinnxcode` + `sixbails` family, 4-package `log-taker` / `ts-escrow` sibling cluster, 5-package `txs-*` + `chai-log` operator cluster, 3-package `@403name/*` typosquat cluster, 4-package `edu-npm-*` "educational" postinstall family, `@wrenfield/abitype` + `@wrenfield/viem` crypto-SDK typosquats, `@kalipto/local` + `kalipto-runtime`, `@ceeferenderer/*` dep-confusion pair, `ap3-components-ui` v9.999.0 dep-confusion, `permcserver` / `permcarmserver`, plus singletons) retired 2026-07-27 01:02–05:36 UTC](https://dependencywatch.io/incident/npm-2026-07-27-ghsa-malware-sweep.md) - 2026-07-27 · high · advisory sweep · npm · 46 packages. On 2026-07-27 01:02 → 05:36 UTC GitHub retired **47 npm CWE-506 malware advisories** in a single overnight batch. Twelve clusters spanning crypto-wallet typosquats (`thirdweb` / `rainbowkit` / `@wrenfield/viem`), WhatsApp-Baileys scrapers (`fazz*`, `@vinnxcode`, `sixbails`, `amanexzyra-baileys`), dependency-confusion (`ap3-components-ui@9.999.0`, `@ceeferenderer/*`), postinstall droppers (`txs-*`, `chai-log`, `edu-npm-*`, `@403name/*`), plus singletons. All 47 packages security-replaced with `0.0.1-security` sentinel tarballs. - [GitHub Advisory npm CWE-506 backfill - 19 "John Wick 4" Spanish-SEO-spam autopublisher packages + `-pem-misa` tea.xyz farmer swept 2026-07-25 (all long-unpublished from npm)](https://dependencywatch.io/incident/npm-2026-07-25-ghsa-tea-xyz-backfill.md) - 2026-07-25 · medium · advisory sweep · npm · 20 packages. On 2026-07-25 GitHub retired 20 npm CWE-506 malware advisories in a **historical backfill batch** - 19 SEO-spam autopublisher packages named after the 2023 movie "John Wick: Chapter 4" (all originally published 2023-03-23, unpublished 2023-03-27), plus `-pem-misa@1.3.3` (published 2024-05-24, part of the Indonesian tea.xyz token-farming autopublisher wave). No credential-stealer or wallet-drain payload - these are token-farming and SEO-spam packages that have been off the public npm registry for 1-3 years. - [GitHub Advisory malware sweep - 10-package `svelte-*-streak` / `eth-*` typosquat cluster (`eth-base` / `eth-slint` / `eth-codergen` / `streak-lib-math` / `svelte-streak-metrics`), `chai-as-stringify` `chai` v7 typosquat, `svgcraft-core` 8-version dropper, and `yuinpm` 68-version prolific-publisher cluster swept 2026-07-23 late-batch](https://dependencywatch.io/incident/npm-2026-07-24-ghsa-malware-sweep.md) - 2026-07-24 · high · advisory sweep · npm · 10 packages. On 2026-07-23 15:39 → 20:10 UTC GitHub retired **10 additional npm CWE-506 malware advisories** in a later batch beyond the earlier 19-package sweep. Five clusters: 4-package `streak-*` / `svelte-*-streak` extending the 2026-07-21 wave; 3-package `eth-*` Ethereum typosquat; `chai-as-stringify` v7 typosquat; 8-version `svgcraft-core` dropper; and `yuinpm` - 68 date-tagged malicious versions. - [GitHub Advisory malware sweep - 4-package `app-data-*` / `app-node-*` v2.1.6 typosquat cluster (`app-data-layer`, `app-node-layer`, `app-data-ist`, `app-data-lts`) coordinated security-replace on 2026-07-24](https://dependencywatch.io/incident/npm-2026-07-24-app-cluster-ghsa-sweep.md) - 2026-07-24 · high · advisory sweep · npm · 4 packages. On 2026-07-24 17:19:21 → 17:19:45 UTC (a 24-second window) GitHub retired **4 npm CWE-506 malware advisories** for a tight `app-*`-prefixed typosquat/dependency-confusion cluster: `app-data-layer`, `app-node-layer`, `app-data-ist`, `app-data-lts` - all published as `2.1.6`, all detected in a single coordinated pipeline sweep. - [GitHub Advisory malware sweep - 6-package crypto-wallet-drainer typosquat cluster (`ethers*` / `bs58-88` / `@bcryptln/*`), 7-package `version-110`/`version-22` dependency-confusion burst (`helix-deploy` / `vue-demi-fix` / `xrblocks-*` / etc.), and 6-package late-July typosquat/misc set swept 2026-07-23](https://dependencywatch.io/incident/npm-2026-07-23-ghsa-malware-sweep.md) - 2026-07-23 · high · advisory sweep · npm · 19 packages. On 2026-07-23 GitHub's Advisory Database retired 19 CWE-506 npm malware advisories in a coordinated 2-hour security-replace window. Three clusters emerge: a **6-package crypto-wallet-drainer typosquat cluster** (`ethers-packge`, `ethers-wallet-package`, `ethers-wallet-packages`, `bs58-88`, `@bcryptln/bcryptjs`, `@bcryptln/becryptjs`) whose names ape the `ethers`, `bs58`, and `bcryptjs` crypto/hashing libraries; a **7-package `version-110`/`version-22` dependency-confusion burst** (`helix-deploy`, `vue-demi-fix`, `xrblocks-remote-control`, `lychee-norm-cache`, `create-kumo-project`, `aio-commerce-lib-app`, `eslint-angular-react`) using deliberately-inflated major versions to shadow internal-registry names; and a **6-package late-July typosquat/misc set** (`vitest-axios`, `fs-extra-core`, `cktool-core`, `mcp-notes-server-poc-praetorian`, `base65-85x`, `da-sc-sdk`). - [GitHub Advisory malware sweep - `encryptstring*` 3-package cluster, `react-tabulix-ui` 3-version burst, `vantora` 2-version pair, and `kijai` singleton swept 2026-07-22](https://dependencywatch.io/incident/npm-2026-07-22-ghsa-malware-sweep.md) - 2026-07-22 · high · advisory sweep · npm · 6 packages. On 2026-07-22 GitHub's Advisory Database retired six CWE-506 npm malware advisories. Dominant cluster: three `encryptstring*` packages (`encryptstringadmin`, `encryptstringadmincore`, `encrypt-string-ttak`) with 9 combined versions security-replaced within a 20-second window at 20:37 UTC - a coordinated single-actor `encryptstring`-themed publish burst. Also swept: `react-tabulix-ui` 3-version burst, `vantora` 2-version pair, and the pre-existing `kijai` singleton. - [GitHub Advisory malware sweep - 3-package `streak-*` habit-tracker cluster, `@apexfdn/apex` 33-version dependency-confusion burst, `nolby` 4-version rapid-burst, and `veskra` singleton swept 2026-07-21](https://dependencywatch.io/incident/npm-2026-07-21-ghsa-malware-sweep.md) - 2026-07-21 · high · advisory sweep · npm · 6 packages. On 2026-07-21 GitHub's Advisory Database retired six CWE-506 npm malware advisories. Highlights: a 3-package `streak-*` habit-tracker cluster (`streak-daycount`, `streak-calendar`, `svelte-streaks`) published within a 56-minute window on 2026-07-21 and security-replaced 8 hours later, a `@apexfdn/apex` 33-version 2.5-week dependency-confusion burst (`1.0.0` → `1.0.32`), and a `nolby` 4-version 4-hour rapid-burst. - [GitHub Advisory PyPI mass backfill - ~10,000 CWE-506 malware advisories published in a single day dominated by yfinance/python-binance/requests/tensorflow typosquats, wallet* crypto-stealer cluster, and xolo/lib*/py-mine* random-blob clusters](https://dependencywatch.io/incident/pypi-2026-07-21-ghsa-mass-backfill.md) - 2026-07-21 · high · advisory sweep · PyPI · 223 packages. On 2026-07-21 GitHub's Advisory Database published a ~10,000-package PyPI CWE-506 malware backfill (400 GHSA pages × 25/page) - the largest single-day GHSA malware batch ever recorded, spanning the entire alphabet in descending order. Dominant themes: `yfinance` typosquats (~20 variants), `python-binance`/`requests`/`tensorflow`/`beautifulsoup`/`websockets` typosquats, a `wallet*` crypto-stealer cluster (~15 packages), a `xolo*` random-name blob cluster (~50 packages), and coordinated `lib{cv,craft,ed}*` random-word-combo clusters. - [GitHub Advisory malware sweep - 5-package AWS/CDK dependency-confusion cluster, `upjsma` 9-version 3-day burst, and 80-package `@gocortexio/npmgremlinbox-*` Cortex red-team validation kit swept 2026-07-20](https://dependencywatch.io/incident/npm-2026-07-20-ghsa-malware-sweep.md) - 2026-07-20 · high · advisory sweep · npm · 86 packages. On 2026-07-20 GitHub's Advisory Database retired 86 CWE-506 npm malware advisories in a single sweep. Highlights: a 5-package AWS/CDK dependency-confusion cluster (`alb-lambda-cdk`, `s3-lambda-dynamodb-cdk`, `lambda-cloudwatch-cdk`, `iot-kfh-s3`, `lwc-slds-lbc`) published within a 20-minute window on 2026-07-18 with high dep-confusion pins, `upjsma` (9 versions across 3 days), and the 80-package `@gocortexio/npmgremlinbox-*` red-team validation kit from the Palo Alto Networks Cortex ecosystem tooling org. - [GitHub Advisory backfill sweep - ~264 NuGet CWE-506 malware advisories dominated by Solana wallet impersonators, WPF/WinForms UI-kit typosquats, and popular-API impersonators (Zendesk, Binance, Coinbase, Ripple, Stripe, PayPal, Kraken, Kucoin, Huobi, Bybit)](https://dependencywatch.io/incident/nuget-2026-07-20-ghsa-backfill-sweep.md) - 2026-07-20 · high · advisory sweep · NuGet · 174 packages. On 2026-07-20 GitHub's Advisory Database published a ~264-package NuGet CWE-506 malware backfill - the largest single-day NuGet sweep on record. Dominant themes: Solana/crypto wallet impersonators (~15 packages: `Solana`, `SolanaWallet`, `solananet`, `solnetplus`, `solnetall`, `solnetunified`, `solnetwallet.net.core`), WPF/WinForms UI-kit typosquats (~40 packages: `WPF-UI-Net`, `WpfAnimatedGif.Net`, `WpfLightToolkit.Net`, `LiveCharts.net`, `Bunifu.*`), Oracle Cloud SDK impersonators (`OCI.DotNetSDK.*`, ~25 packages), and crypto-exchange API impersonators (`Binance`, `Kucoin`, `Kraken`, `Bybit`, `Coinbase`, `Huobi`, `Ripple`). - [GitHub Advisory malware sweep - 8 npm packages (3-package `syft-acp-*` "click2ai" dep-confusion beacon, 2-package `@edgecommons/*` preinstall-hook pair, `axios-native` + `telemetry-axios` axios typosquats, `easyway2` 12-version 4-hour burst) retired 2026-07-17 → 2026-07-18](https://dependencywatch.io/incident/npm-2026-07-18-ghsa-malware-sweep.md) - 2026-07-18 · high · advisory sweep · npm · 8 packages. On 2026-07-17 and 2026-07-18 GitHub's Advisory Database retired 8 CWE-506 npm malware advisories. Highlights: a 3-package `syft-acp-*` dependency-confusion trio published by npm account `ada8877` that beacons victim IP + hostname to a Sentry ingest endpoint (byte-for-byte reuse of the earlier "click2ai" reconnaissance payload), a 2-package `@edgecommons/*` preinstall-hook pair, and axios typosquats `axios-native` + `telemetry-axios`. - [crates.io dependency-confusion burst - 9 Rust crates targeting AWS, Mysten Labs, Replit, Proton, plus 4 generic-name typosquats, all flagged by OpenSSF Package Analysis on 2026-07-18](https://dependencywatch.io/incident/crates-2026-07-18-openssf-typosquat-burst.md) - 2026-07-18 · high · dependency confusion · crates.io · 9 packages. On 2026-07-18 the OpenSSF Package Analysis project flagged 9 Rust crates as malware - all yanked from crates.io within hours and mirrored into the GitHub Advisory Database as CWE-506 records. The 99.x.x version pins on `mysten-metrics`, `amzn-codewhisperer-streaming-client`, `amzn-consolas-client`, `replit_ruspty`, `semantic-search-client`, `supertag`, `proton-pfff`, and `lsh` are classic dep-confusion telltales. Every crate communicates with an attacker-controlled domain and executes commands on install. - [GitHub Advisory malware sweep - 3 PyPI packages retired 2026-07-18 (`govpkg` telegra.ph-C2 downloader + persistent fake-service; `trongridev`/`trongridme` Tron private-key exfil pair)](https://dependencywatch.io/incident/pypi-2026-07-18-ghsa-malware-sweep.md) - 2026-07-18 · high · advisory sweep · PyPI · 3 packages. On 2026-07-18 GitHub's Advisory Database retired 3 CWE-506 PyPI malware advisories. Highlights: `govpkg` (versions 0.1.0, 0.2.0 - the OSSF-tagged `2026-07-govpkg` campaign) silently downloads a native executable, disguises it as a system service for persistence, and uses `telegra.ph` (Telegraph anonymous-publishing) as C2; and a `trongridev`/`trongridme` Tron private-key exfil pair (both v0.0.1) from the recurring OSSF `2025-04-tronix` campaign. - [SleeperGem - dormant RubyGems maintainer takeover drops persistent developer-laptop backdoor via `git.disroot.org` Forgejo second-stage (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab)](https://dependencywatch.io/incident/rubygems-2026-07-18-sleepergem-dormant-maintainer-takeover.md) - 2026-07-18 · high · compromise · RubyGems · 3 packages. On 2026-07-18 → 07-19 an actor reactivated two long-dormant RubyGems maintainer accounts (Dendreo, dormant since 2020; fastlane-plugin-run_tests_firebase_testlab, dormant since 2019) and published a brand-new `git_credential_manager` gem impersonating Microsoft's Git Credential Manager. Seven malicious releases across three gems fetch a second-stage binary from `git.disroot.org/git-ecosystem/*` (Forgejo), skip execution if any of ~30 CI env vars are present, and drop a persistent native daemon on developer laptops. - ["Polymarket Trap" - fake arbitrage-bot repo funnels DeFi devs to a 30-package infostealer cluster](https://dependencywatch.io/incident/npm-2026-07-17-polymarket-trap-clob-client-math.md) - 2026-07-17 · high · typosquat · npm · 12 packages. SafeDep and Panther jointly disclosed the "Polymarket Trap" on 2026-07-17: a fake `Trum3it/polymarket-arbitrage-bot` GitHub repo (36 stars, 53 forks) whose `package.json` declares `clob-client-math` as a peer utility that is never `import`ed. The 30-package cluster spans 10 coordinated npm accounts under two profiles - Polymarket / CLOB SDK impersonators (`clob-client-math`, `polymarket-stake-math`, `polymarket-trade` and siblings) and DeFi-math typosquats (`bn-lint`, `ts-precision`, `decimal-format-utils`). A `postinstall` hook drops a 2,787–2,887-line JavaScript infostealer that harvests crypto wallets, browser vaults, SSH keys, cloud tokens, and password-manager databases. - [GitHub Advisory malware sweep - 18 npm packages (2 Claude / Anthropic-brand typosquats, 3-package `chain-sdk-js` / `theta-sdk-js` / `ai-pro-sdk` mid-July SDK cluster, 3-package `ai-p2p` / `websight-p2p` / `websight2-p2p` June 15 P2P burst, 3 auto-publisher sleepers `px8my` (55 versions) / `monogrok` (21 versions) / `scan-only` (16 versions), plus WordPress Gutenberg / terminal-toy / singleton fillers) retired 2026-07-16 → 2026-07-17](https://dependencywatch.io/incident/npm-2026-07-16-ghsa-malware-sweep.md) - 2026-07-16 · high · advisory sweep · npm · 18 packages. On 2026-07-16 and 2026-07-17 GitHub's Advisory Database retired 18 CWE-506 npm malware advisories (separate from 2 additional `chai-as-*` retirements folded into the existing jsonspack DPRK incident). Highlights: `anthropic-claude-latest` - a version-matched (`4.7.1` / `4.7.2` / `4.7.3`) typosquat of Anthropic's Claude Code CLI - and `claude-token-tracker-mcp`, an MCP-shape package targeting Claude Code's OAuth-token traffic (matching the Mitiga Labs "MCP token theft" attack chain that abuses `.claude.json`). - [GitHub Advisory malware sweep - 25 npm packages (6-package `@sauruslord` / `zaldy-baileys` WhatsApp-Baileys-fork cluster, 4-package `webpack-cache-*` / `vite-config-optimizer` 35-day dep-confusion sleeper, `patientdocuments` + `fhirproxy-utils` FHIR/healthcare pair, `@bcs-mi-ui` 3-package internal cluster, `js-shared-modules` scope-pair) retired 2026-07-15](https://dependencywatch.io/incident/npm-2026-07-15-ghsa-malware-sweep.md) - 2026-07-15 · high · advisory sweep · npm · 25 packages. On 2026-07-15 GitHub's Advisory Database retired 25 CWE-506 npm malware advisories in four clean bursts. Highlights: a 6-package `@sauruslord` / `zaldy-baileys` / `saurus-assets` Baileys WhatsApp-API fork cluster (retired inside a 65-second window at 05:11-05:12 UTC - same operator signature as the earlier `@skyzopedia/baileys-mod` and `lotusbail` WhatsApp-message-stealer campaigns), a 4-package `webpack-cache-cycle` / `webpack-session-cache` / `webpack-cache-reset` / `vite-config-optimizer` 35-day sleeper retired in a 15-second burst, and a healthcare-targeted `patientdocuments@75.0.0` + `fhirproxy-utils` FHIR-namespace dep-confusion pair. - [AsyncAPI npm org compromised - 4 packages / 5 versions ship Miasma botnet loader via GitHub Actions `pull_request_target` pwn request](https://dependencywatch.io/incident/npm-2026-07-14-asyncapi-miasma-actions-pwn-request.md) - 2026-07-14 · critical · compromise · npm · 4 packages. On 2026-07-14 an attacker exploited a `pull_request_target` misconfiguration in `asyncapi/generator` to steal a highly-privileged GitHub PAT, then published five malicious `@asyncapi/*` releases through the project's own trusted GitHub Actions release pipeline - valid npm OIDC provenance and all. The payload fires on `require()`, spawns a detached Node process, fetches an 8.25 MB IPFS loader (Miasma), and installs a 3.09 MB implant with six independent C2 channels (HTTP, Nostr, IPFS, BitTorrent DHT, libp2p GossipSub, Ethereum smart contract). Combined weekly downloads: ~2.9M. - [PhantomSync - 8-package npm crypto-developer cluster with delayed self-persisting dropper](https://dependencywatch.io/incident/npm-2026-07-14-phantomsync-crypto-wallet-dropper.md) - 2026-07-14 · high · malicious package · npm · 8 packages. Between 2026-07-13 and 2026-07-14 the npm publisher `solbuilder_io` (angel_lopez89@proton.me) shipped eight small crypto-developer packages - `base58-utils`, `abi-encode`, `eth-dev`, `arb-kit`, `layer2-sdk`, `solana-key-utils`, `eth-wallet-helpers`, `crypto-validate-lib` - each carrying a working utility plus a self-invoking dropper that fires ~37s after import, installs cross-platform persistence, and launches an RSA-4096 crypto-wallet stealer exfiltrating to public IPFS. npm-support unpublished every version on 2026-07-14 17:23 UTC. - [GitHub Advisory malware sweep - 14 npm packages (10-package `getd-*` / `get*` 40-day Spanish-enterprise sleeper cluster, `pure-folder-three` poisoned bump, `dotnet-runtime-base` fresh burst, `node-sysmetrics`, `@jplopezy/connectivity-test-do-not-install`) retired 2026-07-13](https://dependencywatch.io/incident/npm-2026-07-13-ghsa-malware-sweep.md) - 2026-07-13 · high · advisory sweep · npm · 14 packages. On 2026-07-13 GitHub's Advisory Database retired 14 CWE-506 npm malware advisories. The main event is a 10-package `getd-*` / `get*` Spanish-enterprise dep-confusion sleeper cluster (all `0.0.1` published in a 22-second burst 2026-06-03 13:48–13:49 UTC, dormant for 40 days, then retired in a 47-second take-down burst at 04:51–04:52 UTC). Also included: a maintainer-takeover-style poisoned bump on `pure-folder-three@0.7.3`, `dotnet-runtime-base@{1.0.4,1.0.5}` in a same-day fresh burst, `node-sysmetrics@1.0.0`, and `@jplopezy/connectivity-test-do-not-install`. - [GitHub Advisory malware sweep - 11 npm packages (Higher Logic / AT&T eBiz / Amtrav / babel-eslint dep-confusion continuation, `type-*` 3.3.7 micro-cluster, `authvaultx` + `auth-next-gen` auth-typosquat pair) taken down 2026-07-10 / 2026-07-11](https://dependencywatch.io/incident/npm-2026-07-11-ghsa-malware-sweep.md) - 2026-07-11 · high · advisory sweep · npm · 11 packages. On 2026-07-10 (late-day) and 2026-07-11 GitHub's Advisory Database retired 11 CWE-506 npm malware advisories that arrived after the [earlier 2026-07-10 sweep](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep). Highlights: enterprise dependency-confusion continuation (`@higherlogic/ocfe`, `@att-ebiz/abs-components-bc`, `@amtrav/webservice`, `babel-eslint-parser-legacy` - all `99.9.1` race pins staged 2026-07-07 08:25–08:31 UTC), a `type-elint` / `type-plint` / `type-atob` micro-cluster (all `3.3.7`, published 2026-07-10 14:13–15:30 UTC), and an `authvaultx` + `auth-next-gen` auth-typosquat pair replaced 2026-07-11 00:06 UTC. - [Official `jscrambler` npm package compromised - 5 malicious releases drop a cross-platform Rust infostealer (Chrome/Brave/Edge/Chromium profiles, Bitwarden vault, Steam sessions, cloud metadata, MetaMask/Phantom/Exodus wallets)](https://dependencywatch.io/incident/npm-2026-07-11-jscrambler-rust-infostealer.md) - 2026-07-11 · critical · compromise · npm · 1 package. On 2026-07-11 15:12 UTC the official `jscrambler` npm package was hijacked via the `jscrambler_` maintainer account. Five malicious releases (`8.14.0`, `8.16.0`, `8.17.0`, `8.18.0`, `8.20.0`) shipped a Rust infostealer that harvests Chromium browser profiles, the Bitwarden vault, Steam sessions, AWS/Azure/GCP credentials, and MetaMask/Phantom/Exodus wallet seeds. - [GitHub Advisory malware sweep - 25 npm packages (Epic Games / Unreal Engine internal-scope dependency-confusion cluster, LuminaryCloud, Reddit Voyager, nodemon family) taken down 2026-07-09 / 2026-07-10](https://dependencywatch.io/incident/npm-2026-07-10-ghsa-malware-sweep.md) - 2026-07-10 · high · advisory sweep · npm · 25 packages. On 2026-07-09 and 2026-07-10 GitHub's Advisory Database retired 25 CWE-506 *Embedded Malicious Code* npm advisories. The main story is a **coordinated dependency-confusion burst against internal enterprise namespaces** - Epic Games / Unreal Engine build tooling (`robomerge`, `unreal-horde-dashboard`, `ue-jenkins-buildkite`, `ue-automation-scripts`, `epic-internal-tools`), LuminaryCloud (`@luminarycloudinternal/*`), Reddit-style Voyager UI (`voyager-web`, `searchresults`), plus workspace/microsite scopes - all replaced by npm Security within a 12-minute window on 2026-07-10 02:57–03:10 UTC. A smaller tail of `nodemon-*` / `chai-redirection` / `paperclip-adapter-helpers` typosquats and 2026-07-09 throwaways (`none123s`, `tslint-conf`) rounds out the sweep. - [GitHub Advisory malware sweep - 20 npm packages (Claude-Code / Vue-CLI "clavue" typosquat cluster, `na-rony` throwaway sextet, tailwind-core, common-tg-service six-month sleeper) taken down 2026-07-08 / 2026-07-09](https://dependencywatch.io/incident/npm-2026-07-08-ghsa-malware-sweep.md) - 2026-07-08 · high · advisory sweep · npm · 20 packages. On 2026-07-08 and 2026-07-09 GitHub's Advisory Database retired ~20 CWE-506 *Embedded Malicious Code* npm advisories, continuing the July take-down cadence at ~20 packages/day. Two distinct clusters: a **`clavue` / Claude-Code typosquat family** (`myclaude-code`, `clavue`, `clavuepro`, `calvuepro`, `clavue-agent-sdk`) targeting Anthropic AI CLI developers; and a **`na-rony*` throwaway sextet** - six packages published by one operator between 2026-07-08 03:22–03:39 UTC. Plus a `tailwind-core` typosquat carrying a real `4.3.x` version history and the six-month sleeper `common-tg-service` with 547 versions. - [@injectivelabs/sdk-ts + 16 sibling packages compromised - wallet-key stealer shipped via GitHub maintainer takeover](https://dependencywatch.io/incident/npm-2026-07-08-injectivelabs-sdk-ts-crypto-wallet-drain.md) - 2026-07-08 · critical · compromise · npm · 17 packages. On 2026-07-08 20:59 UTC an attacker with a compromised maintainer GitHub account published `@injectivelabs/sdk-ts@1.20.21` and pinned the same `1.20.21` version across 16 sibling `@injectivelabs/*` wallet + core packages. The malicious release hooked `fromMnemonic` and `fromHex` with a `trackKeyDerivation` telemetry stub that base64-encoded stolen mnemonics/private keys and POSTed them to `testnet.archival.chain.grpc-web.injective.network`. Injective Labs replaced with `1.20.23` about 49 minutes later; 310 downloads shipped in the window. - [GitHub Advisory malware sweep - ~65 npm packages (AI-SDK typosquat cluster, Solana base58/wallet drainers, SQLite scoped fakes, Nuxt/Chai continuation) taken down 2026-07-07 / 2026-07-08](https://dependencywatch.io/incident/npm-2026-07-07-ghsa-malware-sweep.md) - 2026-07-07 · high · advisory sweep · npm · 62 packages. On 2026-07-07 GitHub's Advisory Database retired ~65 CWE-506 *Embedded Malicious Code* npm advisories (plus a small 2-package 2026-07-08 tail), the second-largest single-day 2026 GHSA npm-malware sweep after 2026-07-06. Distinct clusters: an AI-SDK typosquat family (`openai-agents-helpers`, `ollama-helpers`, `anthropic-toolkit`, `@langgraphjs/toolkit`, `ai-sdk-helpers`, `mcp-server-pg`), Solana `base58` wallet-drainer names, `@sqlite-list/*` / `@sqlite-access/*` throwaway scopes, Nuxt/Chai continuations, plus the `whs4_*` sextet. - [Coordinated npm + PyPI campaign typosquats Paysafe / Skrill / Neteller payment SDKs, exfiltrates keys to AWS](https://dependencywatch.io/incident/multi-2026-07-07-paysafe-skrill-payment-sdk-typosquat.md) - 2026-07-07 · critical · typosquat · npm, PyPI · 12 packages. Socket detected a coordinated cross-registry campaign on 2026-07-07 12:56 UTC: 13 npm and 4 PyPI packages impersonating the Paysafe / Skrill / Neteller payment SDKs, exposing plausible legitimate APIs but shipping a credential-theft module that harvests `KEY` / `SECRET` / `TOKEN` / `PASS` / `AUTH` / `API` env vars and Paysafe API keys and exfiltrates them to attacker-controlled AWS infrastructure. All npm versions unpublished ~2026-07-08 00:25 UTC. - [GitHub Advisory malware sweep - ~155 npm packages (logger/tailwind/eslint/bignumber typosquats, polymarket-onchain-* crypto-drainers) taken down 2026-07-06](https://dependencywatch.io/incident/npm-2026-07-06-ghsa-malware-sweep.md) - 2026-07-06 · high · advisory sweep · npm · 162 packages. On 2026-07-06 GitHub's Advisory Database published ~155 CWE-506 *Embedded Malicious Code* advisories against npm packages - the largest single-day 2026 GHSA npm-malware sweep to date. The batch clusters into six naming families: chalk/pino/winston/`*-logger` pretty-print typosquats, tailwindcss/vite typosquats, eslint / `*-lint-*` helper squats, bignumber.js / crypto-math typosquats, chai `*-as-*` matcher squats, and two `polymarket-onchain-*` crypto-drainer slugs continuing the June cluster. npm replaced every name with `0.0.1-security`. - [paperclip2 / vps-maintenance postinstall reverse shell to 185.112.147.174:7007](https://dependencywatch.io/incident/npm-2026-07-04-paperclip2-reverse-shell.md) - 2026-07-04 · high · typosquat · npm · 5 packages. On 2026-07-04 the OX Research team disclosed npm packages - `paperclip2`, `vps-maintenance`, `vps-maintenance-paperclip-adapter` - published by user `srm0rgan` that hide a `postinstall` reverse shell to `185.112.147.174:7007` inside `package.json`. `paperclip2` ships with no JavaScript files at all, defeating static scanners that only inspect `.js`. Two follow-on names - `paperclip-host-utils` and `vps-adapter-core` - landed 2026-07-07 and joined the same GHSA takedown. - [GitHub Advisory malware sweep - 14 npm packages (TypeScript/API util family, SQL/node-cloud scoped cluster, `@lodash-en` typosquat) taken down 2026-07-03](https://dependencywatch.io/incident/npm-2026-07-03-ghsa-malware-sweep.md) - 2026-07-03 · high · advisory sweep · npm · 14 packages. On 2026-07-03 GitHub's Advisory Database dropped 14 CWE-506 *Embedded Malicious Code* advisories against npm packages, all retired inside a ~30-minute window (15:36–16:06 UTC). The sweep spans three distinct micro-clusters: an unscoped `*-node-utils` / `*-api-*` TypeScript/API-helper family (5 packages, 20+ versions), a SQL-and-cloud scoped cluster on personal namespaces (`@sql-access/`, `@sqlite-node/`, `@sql-trigger/`, `@node-cloud/`), and three miscellaneous typosquats including `@lodash-en/lodash-en`. npm replaced every name with `0.0.1-security`. - [JFrog: Lazarus / OtterCookie `rollup-*-polyfill-core` npm campaign - 6 packages steal AI-coder credentials, browser data and crypto wallets](https://dependencywatch.io/incident/npm-2026-07-03-jfrog-lazarus-rollup-polyfill-ottercookie.md) - 2026-07-03 · critical · typosquat · npm · 6 packages. JFrog Security Research disclosed a 6-package DPRK / Contagious Interview npm campaign that mimics the legitimate [`rollup-plugin-polyfill-node`](https://www.npmjs.com/package/rollup-plugin-polyfill-node) project down to its metadata. First-stage packages carry a base64-encoded `npm install` that fetches an SVG-utility-shaped second stage; the second stage evaluates a payload pulled from JSONKeeper and steals credentials for AWS, Azure, Google Gemini, Anthropic Claude, Windsurf, Cursor, VS Code, SSH and Zsh, plus browser data and crypto wallets. Two of the first-stage packages are STILL live on npm as of 2026-07-04. - [GitHub Advisory malware sweep - 9 npm packages (tailwind/animate typosquats, db-* cluster, `vitest-agent`) taken down 2026-07-02](https://dependencywatch.io/incident/npm-2026-07-02-ghsa-malware-sweep.md) - 2026-07-02 · high · advisory sweep · npm · 9 packages. On 2026-07-02 GitHub's Advisory Database dropped 9 CWE-506 *Embedded Malicious Code* advisories against npm packages published between 2026-05-24 and 2026-07-01. Three distinct micro-clusters were retired within minutes of each other: a Tailwind/animate typosquat trio (`animatecss-postcss-plugin`, `tailwind-animates`, `tailwind-typography-stylecss`), a `db-*` / `cache-*` fake-utility quartet, and the standalone `vitest-agent` Vitest typosquat plus one scoped React Native template. npm replaced every name with a `0.0.1-security` holding tarball. - [`clx-cookieparser` + `clx-cookie-signature` cookie-parser impersonators - DGA-driven RAT dropper cluster (GHSA dropped 2026-06-29, updated 2026-07-01)](https://dependencywatch.io/incident/npm-2026-07-01-clx-cookie-dga-dropper.md) - 2026-07-01 · high · typosquat · npm · 3 packages. `clx-cookieparser` (7 versions `1.4.4`–`1.5.1`) and `clx-cookie-signature@1.2.1` impersonate Express's `cookie-parser` / `cookie-signature`. Both hide a dropper that XOR-derives a C2 IP from key `0x496AAC7E`, then fetches and `eval`s `startup.js` - no install hook, execution fires on first API call. GHSA-jpg2-3r22-63v7 / GHSA-vwwm-x6xj-cfmf, refreshed 2026-07-01. - [`@marketfront` dependency-confusion Wave 4 - 25 npm packages batch-published at `7.0.0` reuse the "Internal package - Platform Engineering Team" lure](https://dependencywatch.io/incident/npm-2026-07-01-marketfront-dep-confusion-wave4.md) - 2026-07-01 · high · dependency confusion · npm · 8 packages. On 2026-07-01 22:59 UTC the npm account `marketfront` created the `@marketfront` scope and batch-published 25 e-commerce / marketing-frontend packages in a ~3-minute window, all at version `7.0.0`. Every package carries a postinstall credential-file harvester (~20 secret files including `~/.ssh`, `~/.aws/credentials`, `~/.kube/config`, `~/.npmrc`, `~/.env`) and the identical README lure "Internal package - Platform Engineering Team" - Wave 4 of the SafeDep-tracked `oob.moika.tech` operator lineage. - [ChocoPoC - trojanized CVE PoC repos deliver ChocoPoC RAT via malicious PyPI packages frint / skytext (Mapbox dataset dead-drop C2)](https://dependencywatch.io/incident/pypi-2026-07-01-chocopoc-frint-skytext.md) - 2026-07-01 · high · malicious package · PyPI · 4 packages. Joint Sekoia / YesWeHack disclosure on 2026-07-01: at least seven trojanized CVE proof-of-concept repositories on GitHub silently pull the malicious PyPI package `frint`, which depends on `skytext`. `skytext` ships a precompiled native extension (`gradient.so` / `gradient.pyd`) that deploys "ChocoPoC" - a Python RAT with shell/Python command execution, browser-credential theft, and Mapbox Dataset API dead-drop C2. Targets vulnerability researchers and pentesters cloning PoC repos. ~2,400 downloads of `skytext` before takedown. ## 2026-06 - [GitHub Advisory malware sweep - 20+ npm packages (chai-as-*, brock-*, rebrandly-*, dep-confusion + typosquat batch) taken down 2026-06-30](https://dependencywatch.io/incident/npm-2026-06-30-ghsa-malware-sweep.md) - 2026-06-30 · high · advisory sweep · npm · 18 packages. On 2026-06-30 GitHub's Advisory Database dropped a coordinated batch of ~25 CWE-506 *Embedded Malicious Code* advisories against unrelated npm packages published between 2026-05-27 and 2026-06-30. The batch mixes at least four distinct sub-clusters: `chai-as-persisted` / `chai-as-assured` (Chai typosquats), `brock-loader` / `brock-react-alerts` (with a `9999.0.0` dep-confusion tag), the `rebrandly-domains-*` pair (both `9999.0.0`), and a wider fan-out of standalone malicious names. - [GHSA-flagged malware brands - 16 autotel-*, 4 awaitly-*, and `ai-sdk-ollama` packages (Nov 2025–Jun 2026) marked embedded-malicious-code on 2026-06-29/30](https://dependencywatch.io/incident/npm-2026-06-30-autotel-awaitly-brand-takedown.md) - 2026-06-30 · high · malicious package · npm · 21 packages. GitHub's Advisory Database dropped CWE-506 (Embedded Malicious Code) records on 2026-06-29 and 2026-06-30 against 21 npm "brand" packages built up over months: the entire `autotel-*` observability family (16 packages, 400+ versions), the `awaitly` promise-utility family (4 packages, ~180 versions), and the `ai-sdk-ollama` Vercel AI-SDK typosquat (55 versions). Every published version of every listed package is now classified as malware. - [Internal-scope dependency-confusion cluster (Deel, Webda, Citi, BSCom, TiVo, CSEO-HR, +) taken down 2026-06-29](https://dependencywatch.io/incident/npm-2026-06-29-internal-scope-dep-confusion-cluster.md) - 2026-06-29 · high · dependency confusion · npm · 10 packages. Between 2026-04-27 and 2026-05-31, ten npm packages impersonating internal corporate scopes - Deel, Webda, Citi ICG, BSCom, TiVo, CSEO-HR, Concerns, Via City Tools, WM - were published at `99.9.1` to win dependency-confusion resolution against the matching private mirrors. npm support unpublished the whole batch on 2026-06-29 between 16:46 and 16:52 UTC and replaced them with `0.0.1-security` holders; GHSA records dropped the same day. - [`@thone33/core-utils` + `@thone33/analytics-injector` + `@thone33/react-helpers` - production-gated c2-stager loader fetched from a GitHub repo](https://dependencywatch.io/incident/npm-2026-06-28-thone33-c2-stager-cluster.md) - 2026-06-28 · high · malicious package · npm · 3 packages. On 2026-06-28 17:08–17:42 UTC the npm account `thone33` (`gptconta847@gmail.com`) published three collaborating packages: `@thone33/analytics-injector` (`1.0.0`, `1.0.1`) that fetches attacker JavaScript from `raw.githubusercontent.com/Dennisfrr/c2-stager/main/the%20assessment.js` and passes the response directly to `eval`; `@thone33/core-utils` (`1.0.0`–`1.0.5`) that depends on `@thone33/analytics-injector: ^1.0.0` and conditionally activates it only when `NODE_ENV === 'production'`; and the newly-catalogued sibling `@thone33/react-helpers` (`1.0.0`–`1.0.4`, backfilled by GHSA on 2026-07-27, GHSA-vxmg-ff8j-2552). All three security-replaced on 2026-07-27 01:29–01:30 UTC. - [`chai-as-persisted` + `chai-as-assured` - jsonspack DPRK campaign restarts with chai-as-* typosquat install-time RCE dropper](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack.md) - 2026-06-27 · high · typosquat · npm · 6 packages. On 2026-06-26 → 2026-06-28 the same DPRK-linked operator behind the March *jsonspack* npm campaign restarted with `chai-as-persisted` and `chai-as-assured` - typosquats of `chai-as-promised` that ship install-time RCE droppers. Four versions across the two packages were published with the same `hello@jsonspack.com` author bug URL, fetching attacker JavaScript from `ipregionchecker.org` via `new Function.constructor` on every `npm install`. - [`crossmint-wallets-sdk` + `@epsteinlovekids483/crossmint-wallets-sdk-pentest` - install-time wallet/credential exfil via Crossmint SDK impersonators](https://dependencywatch.io/incident/npm-2026-06-27-crossmint-wallets-sdk-impersonator.md) - 2026-06-27 · high · typosquat · npm · 2 packages. Between 2026-06-26 13:44 UTC and 2026-06-27 03:09 UTC the npm account `epsteinlovekids483` published two impersonators of the legitimate `@crossmint/wallets-sdk`: a scoped `@epsteinlovekids483/crossmint-wallets-sdk-pentest` (8 rapid versions) that on `require()` exfiltrates AWS keys, SSH keys, npm tokens, `gh auth token`, and Solana keypairs to a `127.0.0.1:8052/exfil` loopback C2; and the unscoped `crossmint-wallets-sdk@1.0.0` that fires `preinstall` and `install` lifecycle scripts to capture host identifiers and POST them to an attacker-controlled endpoint. Both are flagged by CIRCL as MAL-2026-6522 and MAL-2026-6545. - [`ts-einkle` + `ts-ankle` + `ts-einkle-slot` - crypto-wallet drainer / SSH backdoor / big.js typosquat cluster](https://dependencywatch.io/incident/npm-2026-06-27-ts-einkle-ankle-wallet-cluster.md) - 2026-06-27 · critical · typosquat · npm · 3 packages. Between 2026-06-26 and 2026-06-27 a single naming-cluster operator published three new malicious npm packages - `ts-einkle` (5 versions), `ts-einkle-slot` (5 versions), and `ts-ankle` (1 version). All three execute install-time payloads: `ts-einkle` is a full credential and crypto-wallet stealer exfiltrating to `datasecure-service.vercel.app/api/v1`; `ts-ankle` recursively walks the home directory for credential files and installs an SSH public key in `~/.ssh/authorized_keys`; `ts-einkle-slot` typosquats `big.js` and shadow-loads `node-slot` on every `require()`. npm-support replaced all three with `0.0.1-security` holders on 2026-06-29. - [`polymarket-clob-math` - Polymarket SDK impersonator with Vercel-hosted unsigned tarball loader](https://dependencywatch.io/incident/npm-2026-06-27-polymarket-clob-math-vercel-loader.md) - 2026-06-27 · high · typosquat · npm · 1 package. On 2026-06-27 17:20 UTC an operator published `polymarket-clob-math@1.0.4` to npm - an impersonator of the legitimate `@polymarket/clob-client` math helper. A `postinstall` script fetches a JSON config from an unverified Vercel domain (`PSM_PEER_URL`), downloads and extracts an unpinned mutable tarball whose contents the operator can swap at will, and executes the resulting attacker JavaScript on the installer. Internal references (`peer-math.js`, `syncSession`) masquerade it as a benign dependency-sync mechanism. npm-support replaced `1.0.4` with a `0.0.1-security` holder on 2026-06-29. - [`livekit-agents` (npm) + `skillspector` (PyPI) - coordinated multi-ecosystem typosquat exfiltrating to `livekit-agents.xyz`](https://dependencywatch.io/incident/multi-2026-06-27-livekit-agents-skillspector-typosquat.md) - 2026-06-27 · high · typosquat · npm, PyPI · 2 packages. Between 2026-06-27 and 2026-06-28 a single operator published a coordinated multi-ecosystem typosquat campaign exfiltrating to the lookalike domain `livekit-agents.xyz`. Unscoped `livekit-agents` on npm (10 versions, four of them flagged malicious) impersonates the LiveKit Agents SDK while beaconing host telemetry. The PyPI package `skillspector` (8 versions) - an unauthorized fork of a legitimate Nvidia project - exfiltrates every CLI argument to `https://livekit-agents.xyz/skillspector-telemetry`. The shared lookalike domain ties both packages to the same operator. - [`tw-style-utils` - SStar Agent cross-platform RAT delivered via Tailwind Typography typosquat](https://dependencywatch.io/incident/npm-2026-06-26-sstar-tw-style-utils.md) - 2026-06-26 · high · typosquat · npm · 1 package. `tw-style-utils` masqueraded as a Tailwind CSS typography plugin (99% of its code copied from `@tailwindcss/typography`) while ~5KB of top-level IIFE downloader code installed *SStar Agent*, a Windows/macOS RAT with keyboard/clipboard hooks and exfiltration capability. Two versions (`0.7.0`, `0.7.1`) were live on npm from 2026-05-26 17:19 UTC; npm yanked the package and replaced `latest` with a `0.0.1-security` holder on 2026-06-26 05:17 UTC, and GitHub published `GHSA-75cr-ggc5-8h7g` the same day. - [npm typosquat sweep - `pump-stream-logger`, `pump-laserstream-parser`, `pino-zod`, `rollup-plugin-polyfill-connect` yanked](https://dependencywatch.io/incident/npm-2026-06-26-pump-pino-rollup-typosquat-sweep.md) - 2026-06-26 · high · typosquat · npm · 4 packages. On 2026-06-26 npm yanked four malicious typosquat packages within hours of each other - `pump-stream-logger`, `pump-laserstream-parser`, and `pino-zod` were taken down within a 10-second window at 05:10 UTC, and `rollup-plugin-polyfill-connect` followed at 12:16 UTC. All four are GHSA-classified as CWE-506 *Embedded Malicious Code*; the package names target the Helius Solana streaming SDK, the Pino logger family, the Zod validation library, and the `rollup-plugin-polyfill-node` Rollup plugin. - [`@vpms/design-system` - internal-scope dependency-confusion with preinstall env-var exfil to Pipedream](https://dependencywatch.io/incident/npm-2026-06-25-vpms-design-system-pipedream.md) - 2026-06-25 · high · dependency confusion · npm · 1 package. On 2026-06-25 between 15:52 UTC and 17:14 UTC, an operator published four versions of `@vpms/design-system` (`0.1.3`, `1.0.0`, `1.0.1`, `1.1.2`) as a dependency-confusion attack against the internal `@vpms` scope. The preinstall script iterates `process.env` and harvests every variable whose name contains `SECRET`, `TOKEN`, `PASSWORD`, `KEY`, or `CREDENTIAL`, along with hostname, username, and process details, then exfiltrates the payload to a hardcoded Pipedream webhook at `eov0bmnid410yqf.m.pipedream.net`. npm-support replaced all four versions with a `0.0.1-security` holder on 2026-06-29. - [codfish/semantic-release-action - 16 tags retargeted to Miasma imposter commit](https://dependencywatch.io/incident/github-actions-2026-06-24-codfish-semantic-release-action-hijack.md) - 2026-06-24 · critical · compromise · GitHub Actions · 1 package. On 2026-06-24 at 15:39:06 UTC an attacker force-pushed two imposter commits to `codfish/semantic-release-action` and repointed 16 tags - including the floating majors `v2`, `v3`, `v4`, `v5` - to them. Any workflow pinned by tag pulls 781,580 bytes of obfuscated JavaScript that searches GitHub commit-search for the `thebeautifulsnadsoftime` Miasma dead-drop channel and `eval()`s any signed payload, exfiltrating `GITHUB_TOKEN` and `NPM_TOKEN` from release workflows. - [Leo Platform / RStreams - czirker maintainer account hijacked, 20 npm packages backdoored in 3 seconds](https://dependencywatch.io/incident/npm-2026-06-24-leo-platform-miasma-hades.md) - 2026-06-24 · critical · compromise · npm · 2 packages. On 2026-06-24 at 23:04:55 UTC an attacker used the compromised `czirker` npm maintainer account to publish malicious versions of 20 Leo Platform / RStreams packages in a sub-3-second automated burst. Each tarball ships a weaponised `binding.gyp` that hides a `node-gyp` command-substitution payload - the same "Phantom Gyp" hook used in the 2026-06-01 Miasma `@redhat-cloud-services` worm - running a Bun-runtime credential stealer (the Shai-Hulud "Hades" payload) that exfiltrates AWS/GCP/Azure/Kubernetes/Vault/npm/PyPI/GitHub/1Password secrets via the victim's own GitHub token. - [PostCSS lookalike npm typosquats deliver multi-stage Windows RAT (abdrizak / JFrog)](https://dependencywatch.io/incident/npm-2026-06-22-postcss-rat-typosquat-jfrog.md) - 2026-06-22 · high · typosquat · npm · 3 packages. JFrog disclosed three malicious npm packages published by the `abdrizak` account that masquerade as `postcss-selector-parser` tooling. An AES-256-GCM-encrypted blob drops a PowerShell stager which fetches a Windows RAT from `nvidiadriver[.]net`, persists via the registry, and beacons over encrypted HTTP to `95.216.92.207:8080` to steal Chrome credentials and run remote-shell / file-transfer commands. - [`parket-helper` / `ts-ecro` big.js typosquat dropper cluster](https://dependencywatch.io/incident/npm-2026-06-18-parket-ecro-bigjs-typosquat-dropper.md) - 2026-06-18 · high · typosquat · npm · 8 packages. A cluster of npm typosquats impersonating `big.js` shipped verbatim copies of the legitimate library with a single added five-line require of `parket-helper` / `parket-slot` / `new-solt` - three otherwise-empty utility packages whose entire purpose is to execute attacker-controlled JavaScript at import time. GitHub and npm flagged the eight packages and replaced them with `0.0.1-security` holders between 2026-06-18 and 2026-06-19. - [`node-ci-utils` / `win-env-setup` / `macos-ci-utils` npm droppers deliver the NastyC2 Rust post-exploitation framework](https://dependencywatch.io/incident/npm-2026-06-18-nastyc2-rust-implant-droppers.md) - 2026-06-18 · critical · malicious package · npm · 3 packages. Three npm packages - `node-ci-utils@2.1.4`, `win-env-setup@3.0.5/3.0.6`, and `macos-ci-utils@1.0.0/1.0.1` - masqueraded as CI tooling while acting as cross-platform droppers for **NastyC2**, a previously undocumented Rust post-exploitation framework with 80+ commands comparable in scope to Cobalt Strike and Sliver. npm removed all three packages between 2026-06-01 and 2026-06-13; the public disclosure landed in The Hacker News ThreatsDay Bulletin on 2026-06-18. - [Mastra AI npm scope takeover via `easy-day-js` typosquat dropper](https://dependencywatch.io/incident/npm-2026-06-17-mastra-easy-day-js.md) - 2026-06-17 · critical · compromise · npm · 17 packages. On 2026-06-17 between ~01:12 and 02:36 UTC, the dormant `ehindero` contributor account - never revoked from the `@mastra` scope - was used to mass-publish ~144 trojanised `@mastra/*` releases plus `mastra` and `create-mastra`, each declaring a new `easy-day-js` dependency whose `postinstall` hook drops a cross-platform crypto-wallet stealer / RAT. Microsoft attributes the activity to **Sapphire Sleet (BlueNoroff)** with high confidence; combined exposure ~1.1M weekly downloads. - [`shai_hulululud`: first documented anti-AI-scanner protestware npm package](https://dependencywatch.io/incident/npm-2026-06-16-shai-hulululud-ai-scanner-protestware.md) - 2026-06-16 · info · malicious package · npm · 1 package. Socket flagged `shai_hulululud@1.0.48596` (~9.3 MB `index.js`, published 2026-06-16 by npm user `ptchli_knldg`) - protestware whose only purpose is to **probe and disrupt AI-based malware scanners**. The tarball is a single JS file containing millions of repeated comments with prompt-injection content, fake system-override instructions, and context-flooding tokens. Runtime is inert; the payload is the source code itself, weaponised against any LLM-based scanner that ingests it. - [Cyfirma multi-stage crypto-wallet campaign: moralis-sdk, ethers-jss, coinbase-wallet-utils, plus the `ethcompat` ethereum-C2 cluster](https://dependencywatch.io/incident/npm-2026-06-13-cyfirma-moralis-ethcompat-cluster.md) - 2026-06-13 · critical · typosquat · npm · 11 packages. Cyfirma Research disclosed an 11-package npm campaign targeting Web3 / blockchain developers across three clusters: a YouTube-page-gated postinstall trojan in `moralis-sdk` (2.7M+ downloads from the legitimate package name), the `ethers-jss` / `coinbase-wallet-utils` private-key sweepers (both yanked 2026-06-10), three long-lived typosquats (`ganach`, `solidty`, `stelar-sdk`, live since 2024), and the `ethcompat` 5-pack (`hardhat-deploy-utils`, `web3-deploy-helper`, `defi-sdk-core`, `ethers-compat`, `ethereum-dev-utils`) that AES-256-GCM-encrypts stolen creds and embeds them in Ethereum transactions to an attacker wallet. - [Solana FakeFix: JFrog flags 25 npm + PyPI packages stealing Solana keypairs and dev secrets to Telegram](https://dependencywatch.io/incident/multi-2026-06-12-solana-fakefix-jfrog.md) - 2026-06-12 · critical · typosquat · npm · 7 packages. JFrog Security Research disclosed `Solana FakeFix`, a 25-package npm/PyPI campaign with two clusters: ~20 Solana typosquats / "stable-build" forks (`solana-web3-stable`, `solana-rpc-client`, …) promoted via GitHub issue spam by the `PassWord1337` account, and a 5-package CMS-themed Windows loader cluster (`cms-storehub`, `cms-helpgit`, `cms-github`, `to-cms`, `shopifyto-cms`). All variants exfiltrate Solana keypairs, SSH keys, cloud creds, and `.env` secrets to a Telegram bot. - [Atomic Arch: 400+ AUR packages hijacked to ship npm-delivered Rust stealer with eBPF rootkit](https://dependencywatch.io/incident/npm-2026-06-11-atomic-arch-aur-hijack.md) - 2026-06-11 · critical · compromise · npm · 4 packages. Sonatype-2026-003775 (2026-06-11) - attackers hijacked 400+ orphaned Arch User Repository packages and rewrote their PKGBUILDs to pull three malicious npm dependencies (`atomic-lockfile@1.4.2`, `js-digest@4.2.2`, `lockfile-js@1.4.2`). Each drops a Rust ELF credential stealer, loads an eBPF rootkit hiding processes/files/sockets when run as root, persists via systemd, and exfiltrates over Tor onion C2. - [dbmux maintainer-account takeover: four backdoored versions seeded across two release branches](https://dependencywatch.io/incident/npm-2026-06-09-dbmux-maintainer-takeover.md) - 2026-06-09 · critical · compromise · npm · 1 package. Between 2026-06-04 and 2026-06-05 the `dbmux` npm maintainer account (`bhagyamudgal`) was hijacked and four backdoored releases were pushed across both the legacy `1.x` and current `2.x` branches: `1.0.5`, `1.0.6`, `2.2.4`, `2.2.5`. GHSA-62wx-5f55-w8g2 (published 2026-06-09) classifies all four as CWE-506 embedded malicious code: any host that installed or executed them should be treated as fully compromised. npm deprecated every malicious release; the clean latest is `2.2.3`. - [SeedSweep: 10-package npm crypto-wallet drainer published by `aicrypto-xzggg`](https://dependencywatch.io/incident/npm-2026-06-09-seedsweep-aicrypto-xzggg.md) - 2026-06-09 · high · typosquat · npm · 4 packages. On 2026-06-09 between 03:23 and 03:57 UTC the brand-new npm account `aicrypto-xzggg` (`vipsyria88@gmail.com`) shipped 10 Web3-flavoured packages - `wallet-sdk-9`, `swap-sdk-87`, `defi-tools-39`, `farming-tools-12`, and six others - each carrying an identical `postinstall` payload that reads wallet keystores, seed-phrase files, SSH keys, and `.env` files across six chains and exfiltrates them to Telegram bot id `8227918239`. npm unpublished every release ~8 hours later. Disclosed by Xygeni as the **SeedSweep** campaign. - [Hades / Shai-Hulud PyPI wave: bioinformatics, MCP typosquats, and the .pth + Bun startup payload](https://dependencywatch.io/incident/pypi-2026-06-05-hades-shai-hulud-pypi-wave.md) - 2026-06-05 · critical · compromise · PyPI · 34 packages. Between 2026-06-05 and 2026-06-08 the Shai-Hulud / Miasma operator hopped to PyPI as "Hades", trojanising ~33 packages across the `nanguage` bioinformatics cluster (StepSecurity: 19 quarantined projects), monarch-initiative phenotype tooling, and MCP/Flask typosquats. Each ships a `*-setup.pth` startup hook → Bun credential stealer with cross-platform memory scraping. - [IronWorm: Rust-built npm worm with eBPF rootkit and Tor C2 hits 36+ Arweave/WeaveDB packages](https://dependencywatch.io/incident/npm-2026-06-04-ironworm-arweave-weavedb.md) - 2026-06-04 · critical · compromise · npm · 4 packages. JFrog disclosed on 2026-06-04 that a single compromised npm account (`asteroiddao`, tied to Arweave/WeaveDB maintainer `ocrybit`) was used to push malicious versions of 36+ packages carrying IronWorm - a Rust ELF infostealer that loads an eBPF rootkit, exfiltrates over Tor, harvests Exodus crypto wallets, and republishes itself via stolen npm OIDC trust. - [Phantom Gyp Miasma worm hits @vapi-ai/server-sdk and the jagreehal portfolio via binding.gyp](https://dependencywatch.io/incident/npm-2026-06-03-phantom-gyp-vapi-jagreehal.md) - 2026-06-03 · critical · compromise · npm · 26 packages. Between 23:30 UTC on 2026-06-03 and ~01:30 UTC on 2026-06-04 the Miasma worm published a malicious 157-byte `binding.gyp` payload through 57 npm packages and 286+ versions, starting at `@vapi-ai/server-sdk` (~408k weekly downloads) and cascading across the jagreehal maintainer's `autotel-*`, `awaitly-*`, `ai-sdk-*`, `executable-stories-*`, `node-env-resolver-*`, and `wrangler-deploy` portfolio. GitHub Advisories backfilled the full affected-version set across the `autotel-*` family and the wider `awaitly-*` portfolio on 2026-06-29 / 2026-06-30 (16 new `autotel-*` GHSAs plus expanded `awaitly` / `awaitly-mongo` / `awaitly-libsql` / `awaitly-analyze` ranges). - [@sentry-internals / @sentry-browser-sdk profiling-node typosquat via forged Sentry events](https://dependencywatch.io/incident/npm-2026-06-03-sentry-profiling-typosquat.md) - 2026-06-03 · high · typosquat · npm · 2 packages. On 2026-06-03 Nutrient (PSPDFKit) caught a novel two-stage attack: an attacker submitted forged Sentry events through a public browser DSN, displaying "remediation" runbook text that instructed responders (and AI agents) to run `npx @sentry-internals/profiling-node --diagnose`. The typosquat - and its sibling `@sentry-browser-sdk/profiling-node` (v1.0.0–1.0.5) - exfiltrated env, working-directory, and dev-context data to `advisory-tracker.com` before npm replaced both with `0.0.1-security` holders. - [codexui-android exfiltrates OpenAI Codex refresh tokens for ~7 weeks before Aikido disclosure](https://dependencywatch.io/incident/npm-2026-06-02-codexui-android-openclaw.md) - 2026-06-02 · high · compromise · npm · 1 package. Aikido disclosed on 2026-06-02 that every `codexui-android` npm version from `0.1.82` (2026-04-13) through `0.1.125` silently exfiltrates the user's OpenAI Codex `auth.json` - access, refresh, and ID tokens - to `sentry.anyclaw[.]store/startlog`. The malicious code never appeared in the package's GitHub repository, and a companion Android app (50k+ installs) ships the same stealer. - [Miasma: @redhat-cloud-services Mini Shai-Hulud worm compromises 32 npm packages in 72 seconds](https://dependencywatch.io/incident/npm-2026-06-01-miasma-redhat-cloud-services.md) - 2026-06-01 · critical · compromise · npm · 32 packages. On 2026-06-01 an attacker published malicious versions of 32 `@redhat-cloud-services/*` npm packages in a 72-second window. The "Miasma" payload - a reskinned Mini Shai-Hulud worm - drops a preinstall script that runs a Bun-loaded credential stealer, harvests AWS/GCP/Azure/Kubernetes/Vault/GitHub/npm tokens, and exfiltrates to attacker-controlled GitHub repos tagged `Miasma: The Spreading Blight`. ## 2026-05 - [oob.moika.tech dependency-confusion campaign across nine npm scopes (mr.4nd3r50n / ce-rwb / t-in-one)](https://dependencywatch.io/incident/npm-2026-05-28-moika-dependency-confusion.md) - 2026-05-28 · high · dependency confusion · npm · 45 packages. Between 2026-05-28 18:47 UTC and 2026-05-29 09:02 UTC a single operator using the npm aliases `mr.4nd3r50n`, `ce-rwb`, and `t-in-one` pushed dependency-confusion packages across nine corporate-looking scopes (`@cloudplatform-single-spa`, `@t-in-one`, `@ce-rwb`, `@wb-track`, `@data-science`, `@payments-widget`, `@travel-autotests`, `@capibar.chat`, `@sber-ecom-core`). Postinstall stagers exfiltrate `process.env` to `oob.moika[.]tech` with a shared `X-Secret` header. - [vpmdhaj OpenSearch / ElasticSearch / DevOps typosquat burst (14 npm packages, Bun stager → cloud + CI/CD secret theft)](https://dependencywatch.io/incident/npm-2026-05-28-vpmdhaj-opensearch-typosquats.md) - 2026-05-28 · high · typosquat · npm · 14 packages. Microsoft Threat Intelligence flagged 14 typosquat npm packages published on 2026-05-28 by a single new maintainer alias `vpmdhaj` (`a39155771@gmail.com`) in a ~4-hour window. Install-time stager pulls a ~195KB Bun-compiled credential harvester from `aab.sportsontheweb[.]net/x.php` (`X-Supply: 1` header) and exfiltrates AWS, HashiCorp Vault, GitHub Actions and npm publish tokens. - [mouse5212-super-formatter: AI-generated npm infostealer targets Claude AI /mnt/user-data](https://dependencywatch.io/incident/npm-2026-05-26-mouse5212-claude-ai-exfil.md) - 2026-05-26 · high · malicious package · npm · 1 package. On 2026-05-26 a fresh npm publisher pushed five versions of `mouse5212-super-formatter` (1.0.0–1.0.4) that exfiltrate files from Claude AI's `/mnt/user-data` directory to an attacker GitHub repo via a hard-coded PAT. Disclosed by OX Security on 2026-05-27 ("Malware-Slop"); ~676 downloads before npm unpublished all versions. - [Laravel-Lang Composer packages - every git tag retargeted to a malicious fork commit](https://dependencywatch.io/incident/packagist-2026-05-22-laravel-lang-tag-hijack.md) - 2026-05-22 · critical · compromise · Packagist · 4 packages. On 2026-05-22 an attacker with push access to the `laravel-lang` GitHub org retargeted every git tag in `laravel-lang/lang`, `http-statuses`, `actions`, and `attributes` to malicious fork commits. `composer require`/`update` then pulls a `src/helpers.php` backdoor, autoloaded on every PHP request, that exfiltrates cloud and CI/CD secrets to `flipboxstudio.info`. - [TrapDoor / AuditorTrap crypto-stealer campaign across npm, PyPI and crates.io](https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer.md) - 2026-05-22 · critical · malicious package · crates.io, npm, PyPI · 34 packages. Starting 2026-05-22 the **TrapDoor** / **AuditorTrap** campaign pushed 34+ malicious packages (384+ versions) across npm, PyPI and crates.io posing as crypto/DeFi/AI dev tools and fake "security guild" branding. Payloads steal SSH keys, cloud credentials and Solana/Sui/Aptos wallets, and hide zero-width-Unicode prompt injection in `CLAUDE.md`/`.cursorrules` to trick Claude Code and Cursor into running the stealer. - [Packagist cross-ecosystem postinstall attack - 8 Composer packages drop Linux `gvfsd-network` binary](https://dependencywatch.io/incident/packagist-2026-05-22-cross-ecosystem-postinstall-binary.md) - 2026-05-22 · high · compromise · Packagist · 8 packages. Socket disclosed on 2026-05-23 a coordinated campaign that planted a malicious `postinstall` hook in the `package.json` (NOT `composer.json`) of eight Packagist Composer packages - including `devdojo/wave`, `devdojo/genesis`, and `katanaui/katana`. The hook curls a Linux binary `gvfsd-network` from `github.com/parikhpreyash4/systemd-network-helper-aa5c751f`, writes it to `/tmp/.sshd`, and runs it backgrounded. Socket flagged the same payload in 700+ public GitHub repos. - [@common-stack/generate-plugin hijacked - PolinRider-linked RAT in two alpha releases](https://dependencywatch.io/incident/npm-2026-05-21-common-stack-generate-plugin-polinrider.md) - 2026-05-21 · high · compromise · npm · 1 package. Sonatype disclosed on 2026-05-21 that two alpha releases of `@common-stack/generate-plugin` (`9.0.2-alpha.21`, `9.0.2-alpha.22`, published ~2026-05-20–21) ship an install-time stager that pulls a second-stage RAT. Tradecraft overlaps the DPRK-linked PolinRider / Contagious Interview cluster. Package draws ~1,100 weekly downloads as a Node.js plugin scaffolding helper, so any developer machine that ran it during local install should be treated as compromised. - [@antv maintainer takeover (atool) - Mini Shai-Hulud burst across ~300 packages](https://dependencywatch.io/incident/npm-2026-05-19-antv-mini-shai-hulud.md) - 2026-05-19 · critical · compromise · npm · 298 packages. On 2026-05-19 the compromised npm publisher `atool` (Alibaba / AntV co-maintainer) pushed an automated burst of 639 malicious versions across 323 unique packages - the entire `@antv` visualization suite plus widely-used unscoped libraries including `echarts-for-react`, `size-sensor`, and `timeago.js` (>15M combined monthly downloads). Each release adds a `preinstall: bun run index.js` hook running the Mini Shai-Hulud credential-stealer. Attributed to TeamPCP. - [Microsoft `durabletask` PyPI compromised - TeamPCP Mini Shai-Hulud stage-2 dropper](https://dependencywatch.io/incident/pypi-2026-05-19-durabletask-teampcp.md) - 2026-05-19 · critical · compromise · PyPI · 1 package. Three malicious versions of `durabletask` - Microsoft's Python SDK for Azure Durable Functions (~417K monthly downloads) - were uploaded directly to PyPI inside a 35-minute window on 2026-05-19. None correspond to any git tag or CI run; the attacker bypassed Microsoft's pipeline with a stolen PyPI API token. Stage-2 is the full Mini Shai-Hulud credential-stealer with dedicated cloud-secret collectors. Attributed to TeamPCP. Last clean release: `1.4.0`. - [actions-cool/issues-helper + maintain-one-comment - every tag retargeted to TeamPCP imposter commit](https://dependencywatch.io/incident/github-actions-2026-05-19-actions-cool-tag-hijack.md) - 2026-05-19 · critical · compromise · GitHub Actions · 2 packages. On 2026-05-19 an attacker with push access to the `actions-cool` GitHub org force-moved every tag in `actions-cool/issues-helper` (53 tags, including the floating `v1` / `v2`) and `actions-cool/maintain-one-comment` (15 tags) to a single imposter commit. Any workflow pinned to a tag - not a full commit SHA - pulled the imposter `dist/index.js`, which dumps `Runner.Worker` memory to exfiltrate GitHub Actions secrets. Shares C2 (`t.m-kosche.com`) with the same-day @antv and `durabletask` waves; attributed to TeamPCP. - [shopsprint/decimal Go typosquat ships a DNS-TXT command-and-control backdoor](https://dependencywatch.io/incident/go-2026-05-19-shopsprint-decimal-dns-backdoor.md) - 2026-05-19 · high · typosquat · Go · 1 package. Socket disclosed a long-running Go typosquat of `github.com/shopspring/decimal` published as `github.com/shopsprint/decimal` (single-letter swap, `t` for `g`). The typosquat was registered 2017-11-08 and was weaponised on 2023-08-19 in `v1.3.3`, which adds a malicious `init()` that polls a free-dynamic-DNS subdomain for TXT-record commands every five minutes and executes the response via `os/exec`. Dwell time before disclosure: ~33 months. - [Nx Console (nrwl.angular-console) 18.95.0 hijacked via TanStack-stolen GitHub creds](https://dependencywatch.io/incident/openvsx-2026-05-18-nx-console-nrwl-angular-console.md) - 2026-05-18 · critical · compromise · Open VSX · 1 package. A malicious `Nx Console v18.95.0` (publisher `nrwl`, ~2.2M installs across VS Code, Cursor, and JetBrains) shipped to both the VS Code Marketplace and Open VSX on 2026-05-18, live for ~18–36 minutes. Every workspace open fetched a 498KB Mini Shai-Hulud stage-2 dropper from an orphan commit in `nrwl/nx`. Nx telemetry estimates ~6,000 users received the build. Root cause: the May 11 TanStack compromise leaked one Nx Console maintainer's GitHub CLI credentials. Tracked as `GHSA-c9j4-9m59-847w` / `CVE-2026-48027`. - [Megalodon: automated CI/CD workflow injection backdoors 5,561 GitHub repos, propagates to @tiledesk/tiledesk-server on npm](https://dependencywatch.io/incident/multi-2026-05-18-megalodon-tiledesk.md) - 2026-05-18 · critical · compromise · GitHub Actions, npm · 10 packages. On 2026-05-18 an automated campaign nicknamed `Megalodon` pushed 5,718 commits to 5,561 public GitHub repos in six hours, injecting GitHub Actions workflows that exfiltrate CI secrets to `216.126.225.129:8443`. The legitimate Tiledesk maintainer then released `@tiledesk/tiledesk-server` 2.18.6–2.18.12 from the poisoned source - propagating the backdoor to every downstream npm install. - [Leaked Shai-Hulud + Phantom Bot copycats from npm user deadcode09284814](https://dependencywatch.io/incident/npm-2026-05-16-shai-hulud-leak-copycats-deadcode.md) - 2026-05-16 · high · typosquat · npm · 4 packages. Three days after TeamPCP open-sourced the Shai-Hulud worm code (2026-05-13), npm publisher `deadcode09284814` pushed four malicious packages on 2026-05-16: `@deadcode09284814/axios-util`, `axois-utils`, `chalk-tempalte`, and `color-style-utils`. `chalk-tempalte` is the first documented in-the-wild Shai-Hulud clone - a near-verbatim copy of the leaked source with a swapped C2. Tradecraft is well below TeamPCP standard; this is the first copycat wave riding the leak. - [node-ipc dormant-maintainer takeover via expired email domain](https://dependencywatch.io/incident/npm-2026-05-14-node-ipc-dormant-takeover.md) - 2026-05-14 · critical · compromise · npm · 1 package. On 2026-05-14 three malicious `node-ipc` releases (`9.1.6`, `9.2.3`, `12.0.1`) were published from a dormant maintainer account `atiertant`. The attacker re-registered the expired `atlantis-software.net` domain on 2026-05-07 and used npm's password-reset flow to seize publish rights. The payload fires on every `require("node-ipc")` (no lifecycle hook) and exfiltrates 90+ credential categories via DNS TXT queries. `12.0.1` was tagged `latest`, so any unpinned install during the ~60-second window pulled the backdoor. ~822K weekly downloads. - [TanStack + @uipath mini-Shai-Hulud compromise](https://dependencywatch.io/incident/npm-2026-05-shai-hulud-tanstack.md) - 2026-05-11 · critical · compromise · npm, PyPI · 179 packages. On 2026-05-11 between 19:20 and 19:26 UTC, TeamPCP pushed malicious versions across `@tanstack/*`, `@uipath/*`, `@mistralai/*`, and many smaller scopes by chaining `pull_request_target`, GitHub Actions cache poisoning, and runtime OIDC-token extraction from a runner. Same Mini Shai-Hulud credential-stealer as the April SAP campaign. Final tally: 177 packages, 403 versions, >518M cumulative downloads. OpenAI confirmed two compromised employee devices and rotated platform code-signing certificates. - [RubyGems account-creation flood + GemStuffer data dead-drops force signup suspension](https://dependencywatch.io/incident/rubygems-2026-05-11-gemstuffer-flood.md) - 2026-05-11 · medium · malicious package · 0 packages. From 2026-05-11–12 an actor abused a RubyGems account-creation flaw to spin up thousands of bot accounts and upload tens of thousands of gems - 500+ confirmed malicious and yanked. Most were empty placeholders or **GemStuffer** data dead-drops that scraped U.K. council ModernGov portals and re-published the data as `.gem` archives. RubyGems paused new sign-ups; resolved 2026-05-16. - [OceanLotus-attributed ZiChatBot PyPI droppers: uuid32-utils, colorinal, termncolor with Zulip-API C2](https://dependencywatch.io/incident/pypi-2026-05-08-oceanlotus-zichatbot-zulip-c2.md) - 2026-05-08 · high · typosquat · PyPI · 3 packages. Kaspersky GReAT (2026-05-08) re-attributed three PyPI wheels uploaded by an attacker between 2025-07-16 and 2025-07-22 - `uuid32-utils`, `colorinal`, and `termncolor` - to the Vietnam-aligned OceanLotus (APT32) group. The droppers fetch a Windows DLL or Linux `.so`, persist via Run-key or crontab, and load `ZiChatBot`, a Python backdoor that uses public Zulip REST APIs as its C2 channel to blend with normal developer traffic. - [Sicoob.Sdk NuGet impersonator exfiltrates Brazilian banking PFX certificates and passwords via Sentry telemetry abuse](https://dependencywatch.io/incident/nuget-2026-05-05-sicoob-sdk-banking-impersonator.md) - 2026-05-05 · high · typosquat · NuGet · 1 package. `Sicoob.Sdk` 2.0.0–2.0.4 (published to NuGet between 2026-05-05 and 2026-05-06 by an account also named `sicoob`) posed as the official C# SDK for Brazilian credit cooperative Sicoob. When a developer constructed `SicoobClient` with a client ID, PFX path and PFX password, the embedded `Sicoob.Sdk.dll` base64-encoded the PFX file and POSTed it together with the client ID and plaintext PFX password to an attacker-controlled Sentry endpoint. NuGet blocked the package after Socket disclosure on 2026-05-29. - [BufferZoneCorp sleeper attack on RubyGems + Go modules](https://dependencywatch.io/incident/multi-2026-05-01-bufferzonecorp-rubygems-go.md) - 2026-05-01 · high · malicious package · Go, RubyGems · 16 packages. Socket disclosed a coordinated sleeper-package campaign attributed to the GitHub org `BufferZoneCorp` (and RubyGems user `knot-theory`). Initially-clean Ruby gems and Go modules were updated to malicious versions. The Ruby side harvests env vars, SSH keys, AWS secrets, .npmrc, .netrc, GitHub CLI config, and RubyGems credentials; the Go side tampers with GitHub Actions workflows, injects fake executables, and adds SSH persistence via authorized_keys. First confirmed 2026 RubyGems + Go module supply-chain campaign. ## 2026-04 - [PyTorch Lightning + intercom-client + intercom-php coordinated push](https://dependencywatch.io/incident/multi-2026-04-30-mini-shai-hulud-wave2.md) - 2026-04-30 · critical · compromise · npm, Packagist, PyPI · 3 packages. Mini Shai-Hulud wave 2: coordinated April 30 release of `lightning` 2.6.2/2.6.3 (PyPI), `intercom-client` 7.0.4/7.0.5 (npm), and `intercom/intercom-php` 5.0.2 (Packagist) carrying the same Bun-based credential stealer used in the SAP/@cap-js wave. ~11.7MB `router_runtime.js` fires preinstall on npm; a `.pth` file fires at every Python import on PyPI. Worm propagation via stolen GitHub PATs labelled "OhNoWhatsGoingOnWithGitHub:". - [DPRK "PromptMink" campaign uses AI agents to insert @validate-sdk/v2 dependency](https://dependencywatch.io/incident/multi-2026-04-29-promptmink-validate-sdk.md) - 2026-04-29 · high · malicious package · npm, PyPI · 10 packages. ReversingLabs traced a DPRK Famous Chollima / UNC1069 campaign that began with `@hash-validator/v2` in Sept 2025 and evolved through Feb 28, 2026 to insert `@validate-sdk/v2` as the malicious dependency of benign-looking "bait" SDKs aimed at AI coding agents. One AI-authored commit pulled `@solana-launchpad/sdk` into a crypto trading repo. Phase 4 in March 2026 used Rust NAPI modules and 85MB Node SEA bundles to exfiltrate full source trees. 300+ malicious package versions across 60+ unique packages observed. - [SAP / @cap-js mini-Shai-Hulud campaign](https://dependencywatch.io/incident/npm-2026-04-sap-cap-js.md) - 2026-04-29 · critical · compromise · npm · 4 packages. Mini-Shai-Hulud-style attack against SAP-related npm packages on 2026-04-29 09:55–12:14 UTC. Preinstall `setup.mjs` downloads the Bun runtime, runs an obfuscated `execution.js` that exfils GitHub/npm tokens, AWS/Azure/GCP secrets, Kubernetes tokens, and browser passwords via the GitHub GraphQL API. Includes a Russian-locale guardrail and persistence via .claude/ and .vscode/ poisoning. - [elementary-data PyPI package backdoored via GitHub Actions injection](https://dependencywatch.io/incident/pypi-2026-04-24-elementary-data.md) - 2026-04-24 · critical · compromise · Docker, PyPI · 2 packages. An attacker (account `realtungtungtungsahur`) exploited a script-injection flaw in the `elementary-data` release workflow via PR comment, then used the workflow token to forge release commit b1e4b1f3 and trigger the legitimate publishing pipeline. PyPI `elementary-data` 0.23.3 and ghcr.io/elementary-data/elementary 0.23.3 + `latest` shipped a ~245 KB obfuscated payload in `elementary.pth`. Clean 0.23.4 published April 25. - [js-logger-pack npm worm uses Hugging Face datasets as malware CDN + exfil store](https://dependencywatch.io/incident/npm-2026-04-23-js-logger-pack-huggingface.md) - 2026-04-23 · high · malicious package · npm · 1 package. JFrog found 27 malicious versions of `js-logger-pack` (1.1.0-1.1.27) abusing the Hugging Face repo `Lordplay/system-releases` to fetch cross-platform binaries (Windows/macOS x64/macOS ARM64/Linux) and upload stolen data to private datasets. The malware adds keylogging, clipboard capture, browser-session and Telegram Desktop theft, plus an operator command channel. - [Xinference PyPI package backdoored on import](https://dependencywatch.io/incident/pypi-2026-04-22-xinference-teampcp.md) - 2026-04-22 · critical · compromise · PyPI · 1 package. JFrog flagged three consecutive `xinference` releases (2.6.0-2.6.2) on PyPI carrying a TeamPCP-style payload embedded in `xinference/__init__.py` that fires on import. The malware base64-encodes a stage-1 wrapper containing the comment `# hacked by teampcp`, then spawns a detached subprocess that bundles harvested data into `love.tar.gz` and POSTs it with a custom `X-QT-SR: 14` header. TeamPCP publicly denied involvement, claiming a copycat. 600,000+ downloads of malicious wheels. - [Checkmarx KICS Docker images + Open VSX extensions compromised (TeamPCP)](https://dependencywatch.io/incident/multi-2026-04-22-checkmarx-kics-vsx-docker.md) - 2026-04-22 · critical · compromise · Docker, Open VSX · 3 packages. Docker and Socket jointly disclosed a multi-stage compromise of Checkmarx KICS Docker images and Checkmarx VS Code / Open VSX extensions. Trojanised extensions silently install an MCP addon executed via Bun, while the Docker images include a modified KICS binary that encrypts scan output and exfiltrates it. TeamPCP claimed responsibility. - [@bitwarden/cli 2026.4.0 hijacked via Checkmarx GitHub Actions breach](https://dependencywatch.io/incident/npm-2026-04-22-bitwarden-cli-teampcp.md) - 2026-04-22 · critical · compromise · npm · 1 package. TeamPCP pushed a malicious `@bitwarden/cli@2026.4.0` to npm between 17:57 and 19:30 ET on April 22, exploiting Bitwarden's use of the breached `checkmarx/ast-github-action`. `bw_setup.js` fetched Bun 1.3.13 from GitHub and ran a payload that targeted SSH, Git, npm, AWS/GCP/Azure, GitHub Actions secrets, and AI/MCP configs (`.claude.json`, `.kiro/settings/mcp.json`), exfiltrating via `audit.checkmarx.cx`. Live ~90 minutes; Bitwarden confirmed no end-user vault data was accessed. - [CanisterSprawl: self-propagating npm worm hits pgserve + Namastex packages](https://dependencywatch.io/incident/npm-2026-04-21-canisterworm-pgserve-namastex.md) - 2026-04-21 · critical · compromise · npm · 6 packages. Socket and StepSecurity disclosed CanisterSprawl, a self-propagating npm worm that compromised at least 16 versions across Namastex Labs and related publishers from 21 April 2026. The postinstall hook harvests 38 env vars and filesystem secrets, encrypts via AES-256-CBC + RSA-4096, and exfiltrates to an Internet Computer Protocol canister. Stolen npm tokens are reused to publish further malicious versions. Tradecraft matches the earlier TeamPCP CanisterWorm campaign. - [36 fake Strapi plugins on npm deploy persistent implants](https://dependencywatch.io/incident/npm-2026-04-15-strapi-plugins.md) - 2026-04-15 · high · typosquat · npm · 36 packages. Four sock-puppet npm accounts (umarbek1233, kekylf12, tikeqemif26, umar_bektembiev1) uploaded 36 packages over a ~13-hour window impersonating Strapi CMS plugins. Payload evolution moved through 8 variants targeting Redis RCE with cron injection, Docker container escapes, PostgreSQL exploitation on hosts named `prod-strapi`, Python reverse shells on port 4444, and SSH-key backdoors. - [@kindo/selfbot npm package delivers XWorm RAT via 5-stage Astral Warfare chain](https://dependencywatch.io/incident/npm-2026-04-15-kindo-selfbot-xworm.md) - 2026-04-15 · high · malicious package · npm · 1 package. JFrog identified `@kindo/selfbot` (XRAY-964727), a video-game-themed Discord selfbot npm package. A 5-stage chain (JS downloader → 250KB obfuscated batch → PowerShell process injection → XOR-decoded shellcode → XWormClient .NET RAT) installed itself against `explorer.exe` with AMSI/ETW evasion. - [5 NuGet packages impersonate Chinese .NET UI libraries with infostealer payload](https://dependencywatch.io/incident/nuget-2026-04-14-chinese-ui-impersonators.md) - 2026-04-14 · high · typosquat · NuGet · 5 packages. NuGet publisher `bmrxntfj` shipped five packages on 14 April 2026 within ~13 seconds, grafting a .NET Reactor-protected infostealer onto decompiled legitimate libraries. Across 219 total versions they accumulated ~65k downloads, targeting browser creds, crypto wallets, and SSH keys on Windows .NET dev hosts. - [DPRK Contagious Interview campaign expands across 5 ecosystems](https://dependencywatch.io/incident/multi-2026-04-07-contagious-interview-5-ecosystems.md) - 2026-04-07 · high · typosquat · crates.io, Go, npm, Packagist, PyPI · 14 packages. Socket disclosed a fresh wave of DPRK Contagious Interview / FAMOUS CHOLLIMA packages spanning npm, PyPI, Go modules, crates.io, and Packagist. They impersonate logging / license developer tooling and act as staged loaders for credential stealers and RATs across Windows, macOS and Linux. The Windows variant deploys a keylogger and AnyDesk for hands-on access. - [hermes-px PyPI "privacy" AI proxy steals prompts via stolen university infra](https://dependencywatch.io/incident/pypi-2026-04-05-hermes-px.md) - 2026-04-05 · medium · malicious package · PyPI · 1 package. JFrog detected `hermes-px`, masquerading as a privacy-preserving AI proxy. It routed requests through Tor to a stolen Tunisian university API and bundled a 246K-character Anthropic Claude system prompt rebranded as "AXIOM-1". It simultaneously exfiltrated all prompts/responses unencrypted to a Supabase endpoint, bypassing Tor and exposing user IPs. ## 2026-03 - [Axios npm compromise (North Korea-nexus RAT)](https://dependencywatch.io/incident/npm-2026-03-axios.md) - 2026-03-31 · critical · compromise · npm · 4 packages. Lead-maintainer account compromised via social engineering. Two malicious axios releases pulled in plain-crypto-js, whose postinstall fetched a cross-platform RAT from sfrclak[.]com:8000. Microsoft + Google attribute to Sapphire Sleet / UNC1069 (North Korea-nexus). Live for ~3 hours; ~100M weekly downloads in scope. - [LofyGang returns with undicy-http typosquat delivering dual-payload RAT](https://dependencywatch.io/incident/npm-2026-03-31-undicy-lofygang.md) - 2026-03-31 · high · typosquat · npm · 1 package. JFrog tied `undicy-http@2.0.0` (a typosquat of `undici`) to the Brazil-based LofyGang group last seen in 2022. The package pairs a Node.js WebSocket RAT with a native `chromelevator.exe` binary that uses direct syscalls for process hollowing, then injects browser credential stealers targeting 50+ browsers and 90+ wallet extensions. - [Telnyx Python SDK hides credential stealer in WAV-file steganography](https://dependencywatch.io/incident/pypi-2026-03-27-telnyx-teampcp.md) - 2026-03-27 · critical · compromise · PyPI · 1 package. TeamPCP published malicious `telnyx` 4.87.1 and 4.87.2 to PyPI on 27 March 2026 (~670k monthly downloads). Trojanised `_client.py` downloads steganographic payloads disguised as `.wav` files over plaintext HTTP, extracts the credential stealer, and persists. Windows variant drops `msbuild.exe` to the Startup folder; Linux variant uses a user-level systemd service. AES-256-CBC + RSA-4096 envelope for exfil. - [LiteLLM PyPI backdoored as TeamPCP cascade reaches Python](https://dependencywatch.io/incident/pypi-2026-03-24-litellm-teampcp.md) - 2026-03-24 · critical · compromise · PyPI · 1 package. TeamPCP used credentials harvested from the Trivy compromise to publish trojanised `litellm` 1.82.7 and 1.82.8 to PyPI on 24 March 2026 (~10:39 and 10:52 UTC). Malicious wheels drop a `litellm_init.pth` file in site-packages, executing a credential stealer at every Python interpreter start. PyPI quarantined the packages ~40 minutes after publication. Attackers later claimed ~500,000 credentials from this single compromise. LiteLLM averages ~3M daily downloads and ships in ~36% of cloud environments. - [5 npm typosquats target Solana + Ethereum dev libraries, exfil keys to Telegram](https://dependencywatch.io/incident/npm-2026-03-24-solana-ethereum-typosquats.md) - 2026-03-24 · high · typosquat · npm · 5 packages. npm publisher `galedonovan` shipped five typosquats of legitimate crypto libraries. Each transparently intercepts private keys passed through normal API calls (Base58 decoding for Solana, Wallet construction for Ethereum), exfiltrates them to a hardcoded Telegram bot, then returns the expected result so functionality looks normal. - [Checkmarx KICS GitHub Actions trojanised by TeamPCP](https://dependencywatch.io/incident/github-actions-2026-03-23-checkmarx-kics.md) - 2026-03-23 · high · compromise · GitHub Actions · 2 packages. Between 12:58 and 16:50 UTC on 23 March 2026, TeamPCP hijacked 35 tags in the Checkmarx `ast-github-action` and `kics-github-action` repos to push a credential stealer, leveraging tokens stolen from the Trivy compromise. CI/CD pipelines using either Action during the window executed the stealer before the legitimate scan. - [CanisterWorm: @emilgroup and @teale.io npm publisher compromise (29+ packages)](https://dependencywatch.io/incident/npm-2026-03-20-canisterworm-emilgroup-teale.md) - 2026-03-20 · critical · compromise · npm · 29 packages. An attacker compromised the @emilgroup and @teale.io npm namespaces, replacing 58 package-versions with a Python backdoor that polls an Internet Computer Protocol (ICP) canister for follow-on payloads. The implant persists via user-level systemd and includes worm-style republishing via deploy.js. Wiz later linked the tradecraft to TeamPCP; Socket declined firm attribution. - [Trivy GitHub Action + Docker images compromised - start of TeamPCP cascade](https://dependencywatch.io/incident/github-actions-2026-03-19-trivy-teampcp-cascade.md) - 2026-03-19 · critical · compromise · Docker, GitHub Actions · 3 packages. Aqua Security's Trivy scanner was compromised on 19 March 2026 by the threat actor self-identifying as TeamPCP. The attacker force-pushed 76 of 77 tags in `aquasecurity/trivy-action` (only @0.35.0 survived) and all 7 tags in `aquasecurity/setup-trivy` to malicious commits, then published trojanised Trivy binary 0.69.4 + Docker images 0.69.5/0.69.6/latest. A stolen Argon-DevOps-Mgt service-account token seeded the downstream LiteLLM, Telnyx, Bitwarden CLI, and Checkmarx compromises. - [GlassWorm sleeper extensions activate on Open VSX](https://dependencywatch.io/incident/openvsx-2026-03-18-glassworm-sleeper.md) - 2026-03-18 · high · compromise · Open VSX · 2 packages. Roughly 40 malicious VS Code extensions surfaced March 14-18, 2026: 20+ new extensions, ~20 previously dormant sleepers activated, plus 11 extensionPack droppers. The campaign hosts VSIX payloads on attacker-controlled GitHub releases to evade registry takedowns. Publishing accounts: `laura6909`, `martina0094`, `chiara585`, `francesca898`. - [GlassWorm: 72+ Open VSX extensions weaponised via transitive loaders](https://dependencywatch.io/incident/openvsx-2026-03-13-glassworm-transitive.md) - 2026-03-13 · high · compromise · 0 packages. Socket linked at least 72 additional malicious Open VSX extensions to the GlassWorm campaign. Newer variants use `extensionPack` / `extensionDependencies` fields to transitively pull GlassWorm loaders rather than embedding malware directly. Obfuscation rotated to RC4 + base64 with keys delivered in HTTP response headers. - [6 malicious Packagist OphimCMS themes ship trojanised jQuery and FUNNULL redirects](https://dependencywatch.io/incident/packagist-2026-03-12-ophimcms-themes.md) - 2026-03-12 · medium · malicious package · Packagist · 6 packages. Six Composer packages from the `ophimcms` organisation posed as OphimCMS themes containing trojanised jQuery. The payload exfiltrates URLs, injects ads, and redirects mobile traffic via OFAC-sanctioned FUNNULL infrastructure. Combined ~2,750 installs. ## 2026-02 - [5 malicious Rust crates pose as time utilities to exfiltrate .env files](https://dependencywatch.io/incident/crates-2026-02-28-time-utility-typosquats.md) - 2026-02-28 · medium · typosquat · crates.io · 5 packages. Five crates published between late February and early March 2026 posed as local time utilities while exfiltrating .env files via `curl` to a lookalike domain `timeapis.io` (typosquatting `timeapi.io`). All packages were 0.1.0 and yanked within hours. Account aliases: `gehakax777`, `dictorudin`. - [StegaBin: 26 npm typosquats use Pastebin steganography to deliver Contagious Interview RAT](https://dependencywatch.io/incident/npm-2026-02-27-stegabin-contagious-interview.md) - 2026-02-27 · high · typosquat · npm · 26 packages. Socket disclosed 26 typosquatted npm packages tied to North Korea's Contagious Interview / FAMOUS CHOLLIMA cluster. The loader decodes steganographically-encoded Pastebin URLs to resolve C2 hosted across 31 Vercel deployments, then retrieves a 9-module infostealer and RAT toolkit. - [SANDWORM_MODE: 19 npm typosquats with self-spreading worm + AI toolchain poisoning](https://dependencywatch.io/incident/npm-2026-02-20-sandworm-mode.md) - 2026-02-20 · critical · typosquat · npm · 19 packages. Socket disclosed a Shai-Hulud-style self-propagating worm spread across at least 19 typosquatted npm packages from accounts `official334` and `javaorg`. It harvests CI secrets and crypto keys, propagates via stolen npm/GitHub tokens, and injects prompt-injection logic into MCP servers used by AI coding assistants. - [cline npm package hijacked via "Clinejection" prompt-injection chain](https://dependencywatch.io/incident/npm-2026-02-17-cline-clinejection.md) - 2026-02-17 · high · compromise · npm · 1 package. An attacker abused an unsanitised AI issue-triage GitHub Actions workflow on the Cline repo to poison the release pipeline cache and steal the npm publish token. They published `cline@2.3.0` with a postinstall script that globally installed the second-stage package `openclaw`. ~90k weekly downloads; live for ~8 hours before Cline rotated the token and shipped 2.4.0. - [Lazarus "graphalgo" fake-recruiter campaign (npm + PyPI + Go)](https://dependencywatch.io/incident/multi-2026-02-11-lazarus-graphalgo.md) - 2026-02-11 · high · malicious package · Go, npm, PyPI · 32 packages. ReversingLabs attributed an ongoing fake-recruiter campaign (active since May 2025, reported Feb 2026) to North Korea's Lazarus Group (overlapping Jade Sleet / UNC4899). Crypto, JavaScript, and Python developers are lured via LinkedIn/Reddit/Facebook into interview "coding tasks" that pull a token-protected RAT loader from npm and PyPI. ~192 malicious packages attributed in total; bigmathutils alone passed 10,000 downloads. - [Polymarket SDK typosquats on crates.io](https://dependencywatch.io/incident/crates-2026-02-05-polymarket-typosquats.md) - 2026-02-05 · medium · typosquat · crates.io · 3 packages. Three crates impersonating `polymarket-client-sdk` were published between 5 and 19 February 2026 and exfiltrated local credential files. The malicious crates were yanked and publisher accounts disabled. Combined downloads stayed under 100, but targeting was high-value (Polymarket / Web3 developers). ## 2026-01 - [dYdX v4-client npm + PyPI compromise (wallet stealer + RAT)](https://dependencywatch.io/incident/multi-2026-01-27-dydx-compromise.md) - 2026-01-27 · critical · compromise · npm, PyPI · 2 packages. Maintainer credentials for the dYdX decentralized exchange were compromised; malicious versions of the official v4 client were pushed to npm and PyPI in a coordinated release. The npm payload exfiltrates wallet seed phrases through a malicious `createRegistry()` function. The PyPI variant additionally drops a Python RAT executed on import. - [sympy-dev PyPI typosquat delivering XMRig cryptominer](https://dependencywatch.io/incident/pypi-2026-01-17-sympy-dev-miner.md) - 2026-01-17 · high · typosquat · PyPI · 1 package. A PyPI typosquat of SymPy was published by the account "Nanit" across four versions on Jan 17, 2026. It fetches a remote JSON config, downloads an ELF, and executes it from a memfd to evade disk-based detection. The payload is XMRig mining Monero on infected developer workstations. ## 2025-09 - [Original Shai-Hulud npm worm](https://dependencywatch.io/incident/npm-2025-09-shai-hulud-original.md) - 2025-09-15 · critical · compromise · npm · 197 packages. First successful self-propagating worm in the npm ecosystem. Downstream of the August 2025 s1ngularity/Nx GitHub-token theft. The postinstall hook ran TruffleHog to harvest secrets, opened public GitHub repos named "Shai-Hulud" to publish them, force-converted private repos to public with a "-migration" suffix, and used stolen npm tokens to publish malicious versions of any package the maintainer could access. ~180 unique packages compromised across 300+ versions, including CrowdStrike's own scope (@crowdstrike/*). --- Canonical page: https://dependencywatch.io/feed Markdown version: https://dependencywatch.io/feed.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).