# GitHub Advisory malware sweep - 2026-08-17 / 2026-08-18 batch (Sui blockchain `@mysten/*` typosquat days 4-5 continuation `sui-move-graphql`+`sui-move-rpc`+`sui-gql-core`+`bcs-core`+`bucket-protocol-sdk-v2`, Tinkoff BNPL dep-confusion tail `bnpl-blocks-independent-bnpl-search`, LEB128 encoding typosquat pair `leb128x`+`ulebkit`, generic CWE-506 boilerplate `blastradar`+`runtime-health`, PyPI Telegram-RAT trio `socks5901`+`infogram-bot`+`httpz-requests`)

> 13 GHSA CWE-506 advisories across npm + PyPI in the 24h ending 2026-08-18 06:00 UTC (extended 2026-08-19 with two late PyPI Telegram-RAT entries). Headline: **five-package Sui blockchain typosquat continuation** (`sui-move-graphql`, `sui-move-rpc`, `sui-gql-core`, `bcs-core`, `bucket-protocol-sdk-v2`) extends the `@mysten/*` typosquat register into day-4/5. Also: Tinkoff BNPL dep-confusion tail, `leb128x`+`ulebkit` LEB128 typosquat pair, generic CWE-506 pair, and a PyPI Telegram-RAT trio `socks5901`+`infogram-bot`+`httpz-requests`.

- Published: 2026-08-18
- Last updated: 2026-08-19
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 13 packages, 26 compromised versions
- Tags: typosquat, dependency-confusion, crypto-wallet-drain, obfuscation, infostealer
- Also known as: 2026-08-17 GHSA sweep, 2026-08-18 GHSA sweep, Sui @mysten typosquat register day 4-5, Tinkoff BNPL dep-confusion tail, PyPI Telegram-RAT trio
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis
- Incident ID: multi-2026-08-18-ghsa-malware-sweep

## Affected packages (13)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [bcs-core](https://dependencywatch.io/package/npm/bcs-core) | npm | 1.0.0 |
| [blastradar](https://dependencywatch.io/package/npm/blastradar) | npm | 1.0.0 |
| [bnpl-blocks-independent-bnpl-search](https://dependencywatch.io/package/npm/bnpl-blocks-independent-bnpl-search) | npm | 1.0.0 |
| [bucket-protocol-sdk-v2](https://dependencywatch.io/package/npm/bucket-protocol-sdk-v2) | npm | 1.0.0 |
| [httpz-requests](https://dependencywatch.io/package/pypi/httpz-requests) | PyPI | 1.8.0, 1.21.5 |
| [infogram-bot](https://dependencywatch.io/package/pypi/infogram-bot) | PyPI | 1.0.0, 1.2.0, 1.2.1, 1.3.0, 1.4.0, 1.5.0, 1.6.0, 1.6.1, 1.7.0, 1.8.0, 1.9.0 |
| [leb128x](https://dependencywatch.io/package/npm/leb128x) | npm | 1.0.0 |
| [runtime-health](https://dependencywatch.io/package/npm/runtime-health) | npm | 1.0.1, 1.0.2, 1.0.4 |
| [socks5901](https://dependencywatch.io/package/pypi/socks5901) | PyPI | 1.0.0 |
| [sui-gql-core](https://dependencywatch.io/package/npm/sui-gql-core) | npm | 1.0.0 |
| [sui-move-graphql](https://dependencywatch.io/package/npm/sui-move-graphql) | npm | 1.0.0 |
| [sui-move-rpc](https://dependencywatch.io/package/npm/sui-move-rpc) | npm | 1.0.0 |
| [ulebkit](https://dependencywatch.io/package/npm/ulebkit) | npm | 1.0.0 |

## What happened

The 24-hour window ending 2026-08-18 06:00 UTC published 11 new GHSA CWE-506 advisories across npm and PyPI. The [08-17 quiet-tail sweep](https://dependencywatch.io/incident/multi-2026-08-17-ghsa-quiet-tail) noted only 2 advisories in the first half of the window (`@ai-vertical/ai-agent`, `kb-ai`); this file covers the remaining 11 that landed later 08-17 and into 08-18, which reintroduces coordinated-campaign activity absent from the quiet-tail window.

## Cluster A - Sui blockchain `@mysten/*` typosquat continuation days 4-5 (5 npm packages)

| Package | Versions | GHSA | Published | Impersonation target |
|---|---|---|---|---|
| `sui-move-graphql` | `>= 0` (all) | GHSA-xgmm-vq93-f5vx | 2026-08-18 | `@mysten/sui/graphql` GraphQL client |
| `sui-move-rpc` | `>= 0` (all) | GHSA-342c-493g-f389 | 2026-08-17 | `@mysten/sui/client` JSON-RPC client |
| `sui-gql-core` | `>= 0` (all) | GHSA-rg66-wjvq-h8xm | 2026-08-17 | `@mysten/sui/graphql` core |
| `bcs-core` | `>= 0` (all) | GHSA-5w7j-92p9-p5h4 | 2026-08-17 | `@mysten/bcs` Binary Canonical Serialization |
| `bucket-protocol-sdk-v2` | `>= 0` (all) | GHSA-23pf-2cqf-xh64 | 2026-08-17 | `@Bucket-Protocol/bucket-protocol-sdk` Sui DeFi SDK |

All five carry the generic GHSA malware boilerplate: "Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer." No per-package source, IOC, or C2 published.

This is the **fourth and fifth day of a coordinated Sui/Move typosquat register**, following:

- **2026-08-11 (day 1)**: `sui-gql-client`, `sui-bcs-codec` — see [08-11 sweep Cluster H](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep)
- **2026-08-12 (day 2)**: `sui-gql`, `bcs-compact` — see [08-12 sweep Cluster D](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep)
- **2026-08-17 (day 4)**: `sui-move-rpc`, `sui-gql-core`, `bcs-core`, `bucket-protocol-sdk-v2` — this file
- **2026-08-18 (day 5)**: `sui-move-graphql` — this file

The operator is systematically enumerating the Sui developer install-flow: BCS codec (`bcs-core`, `bcs-compact`, `sui-bcs-codec`), GraphQL client (`sui-gql-core`, `sui-gql`, `sui-gql-client`, `sui-move-graphql`), JSON-RPC (`sui-move-rpc`), and now a specific DeFi protocol SDK (`bucket-protocol-sdk-v2`). Bucket Protocol is a real Sui-based CDP / stablecoin project; the `-v2` suffix is a plausible-but-fake successor naming shape.

Given the pattern, treat these as capable of the same wallet-key theft / credential-exfil / `postinstall` dropper behavior seen in the adjacent Sui-targeted TrapDoor campaign catalogued 2026-05-22 (see [TrapDoor incident](https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer)), which specifically exfiltrated Sui / Move / Solana / Aptos wallet keystores and planted hidden prompt-injection instructions in `CLAUDE.md` / `.cursorrules`.

## Cluster B - Tinkoff Bank / Dolyame BNPL dep-confusion tail (1 npm package)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `bnpl-blocks-independent-bnpl-search` | `>= 0` (all) | GHSA-v43r-98qv-2v96 | 2026-08-17 | Generic CWE-506 boilerplate; continuation of Tinkoff BNPL internal-namespace enumeration |

Continues the massive Tinkoff Bank internal-namespace dep-confusion burst first catalogued on [2026-08-05](https://dependencywatch.io/incident/npm-2026-08-05-ghsa-malware-sweep) (25+ Tinkoff-adjacent packages including `bnpl-blocks-atom-bnpl-*`, `dolyame-boxy-*`, `tramvai-*`, `tinkoff-statist-*`) and continued on 2026-08-06 and [2026-08-08](https://dependencywatch.io/incident/npm-2026-08-08-ghsa-malware-sweep) (`bnpl-blocks-desktop-bnpl-anchor-title`). The `bnpl-blocks-independent-bnpl-*` sub-namespace matches the internal Tinkoff Dolyame BNPL React component library shape. The operator is running a slow enumeration burst against Tinkoff's internal npm scope, publishing one or two new squats every few days.

## Cluster C - LEB128 encoding typosquat pair (2 npm packages)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `leb128x` | `>= 0` (all) | GHSA-p98p-7p39-8v79 | 2026-08-17 | Generic CWE-506 boilerplate |
| `ulebkit` | `>= 0` (all) | GHSA-w4vj-4cxr-299x | 2026-08-18 | Generic CWE-506 boilerplate |

LEB128 (Little Endian Base 128) is a variable-length integer encoding used in WebAssembly binary format, DWARF debug info, and — critically — the **Move / Sui BCS (Binary Canonical Serialization) codec**. `ulebkit` targets the ULEB128 (unsigned) variant. The same-week overlap with Cluster A's Sui typosquat continuation is suggestive: LEB128 sits directly under BCS in the Sui codec stack, so an operator running a Move / BCS naming sweep would naturally extend to LEB128 primitives.

## Cluster D - Generic CWE-506 boilerplate misc (2 npm packages)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `blastradar` | `>= 0` (all) | GHSA-pp9x-4g56-7322 | 2026-08-18 | Generic CWE-506 boilerplate |
| `runtime-health` | `1.0.1`, `1.0.2`, `1.0.4` | GHSA-fg74-5f33-c553 | 2026-08-18 | OpenSSF Package Analysis: "executes one or more commands associated with malicious behavior"; source hash `947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832`; OSV ref `MAL-2026-14116` |

`blastradar` shares its name with a legitimate production-risk scanner tool (BlastRadar, a diff-analysis service) - the operator is likely trying to intercept developers searching for that tool. The versioning fingerprint on `runtime-health` (1.0.1, 1.0.2, then skipping to 1.0.4) suggests a mid-cycle takedown-and-republish loop before final removal.

## Cluster E - PyPI Telegram-bot RAT trio (3 PyPI packages; extended 2026-08-19)

| Package | Versions | GHSA | Published | Behavior |
|---|---|---|---|---|
| `socks5901` | `1.0.0` | GHSA-3rcw-hq5f-gvrg | 2026-08-18 | Exfiltrates ALL files from `/sdcard/` at import time via Telegram Bot API webhook; targets Android hosts (Termux/QPython/Pydroid); source hash `e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3`; OpenSSF campaign `2026-08-socks5901`; OSV ref `MAL-2026-14100` |
| `infogram-bot` | `1.0.0`, `1.2.0`, `1.2.1`, `1.3.0`, `1.4.0`, `1.5.0`, `1.6.0`, `1.6.1`, `1.7.0`, `1.8.0`, `1.9.0` | GHSA-22rg-qv4f-2j3p | 2026-08-18 | Full Telegram-based remote-access trojan: file/credential exfil, persistence, native-code extensions, obfuscation. Advisory: *"deliberately created and used to hack other machines"*. Source hash `454fa32963f58275e35167d59dd581240725e099682e76e44b6fca7b22332cb0` |
| `httpz-requests` | `1.8.0` through `1.21.5` (20 versions) | GHSA-pm38-ccxh-j59w | 2026-08-18 | Sibling `requests`-typosquat implementation of the same Telegram-RAT toolchain: RAT capability triggers on import, file/credential exfil to a Telegram bot. Source hash `38eff923106836997e28de6d7173a1553da126be230b341fe64f0c4c215769a2` |

`socks5901` was first indexed on 2026-08-18; `infogram-bot` and `httpz-requests` landed later 08-18 and were folded into this file on 2026-08-19 because vector (Telegram Bot API exfil), publication window, and impact model are identical. `socks5901` is the first Android-targeting PyPI package we've seen in the 2026 ingest run. The `/sdcard/` path is Android internal-storage convention, so the operator specifically targeted developers running Python on Android via [Termux](https://termux.dev/), [QPython](https://www.qpython.org/), or [Pydroid](https://pydroid.tech/). The name masquerades as a SOCKS5 proxy library.

Telegram Bot API as the exfiltration channel is a nasty choice: `api.telegram.org` is allow-listed on most home ISPs and mobile carriers, and the operator can rotate the bot token / channel without republishing the package. The exfil targets (photos, downloaded PDFs, screenshots, chat backups) can be highly sensitive on a personal Android device — including exported wallet KeyStores, mnemonic-phrase screenshots, and 2FA-recovery snapshots.

## Registry state

All 13 packages yanked from their respective registries (npm, PyPI) during the takedown windows on 2026-08-17 / 2026-08-18. Private mirrors that cached tarballs before takedown will keep serving the malicious versions.

## Related tracked activity

- **Sui/Move typosquat multi-day campaign** (Cluster A): continues the [08-11 sui-gql-client/sui-bcs-codec pair](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep) and [08-12 sui-gql/bcs-compact pair](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) into day-4/5. Related upstream: [TrapDoor Sui/Move wallet-keystore stealer](https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer) from May.
- **Tinkoff Bank multi-day dep-confusion burst** (Cluster B): continues the [08-05 25+ package burst](https://dependencywatch.io/incident/npm-2026-08-05-ghsa-malware-sweep) covering `bnpl-blocks-atom-*`, `dolyame-boxy-*`, `tramvai-*`, and `tinkoff-statist-*`.
- **LEB128/Move-adjacent typosquat register** (Cluster C): new pattern this week; may indicate the Sui operator extending to sub-primitive namespaces or a sibling operator riding the same target-list.
- **Android-target PyPI exfiltrator** (Cluster E): first in the current ingest run; Android developer targeting via Termux/QPython/Pydroid is a small-but-real subset of the PyPI attack surface.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`. No named threat actor.

## Impact

- **Cluster A - Sui blockchain typosquat continuation days 4-5 (5 npm packages, 2026-08-17/18)**: `sui-move-graphql@>=0` (GHSA-xgmm-vq93-f5vx, 08-18), `sui-move-rpc@>=0` (GHSA-342c-493g-f389, 08-17), `sui-gql-core@>=0` (GHSA-rg66-wjvq-h8xm, 08-17), `bcs-core@>=0` (GHSA-5w7j-92p9-p5h4, 08-17), `bucket-protocol-sdk-v2@>=0` (GHSA-23pf-2cqf-xh64, 08-17) all carry the generic CWE-506 boilerplate. Names shadow the official `@mysten/sui`, `@mysten/sui/graphql`, `@mysten/bcs`, and `@Bucket-Protocol/bucket-protocol-sdk` libraries. Continues the coordinated Sui/Move typosquat register begun 2026-08-11 (`sui-gql-client`, `sui-bcs-codec`) and continued 2026-08-12 (`sui-gql`, `bcs-compact`). No IOC published per package - treat as capable of the same wallet-key theft, credential-exfil, or `postinstall` dropper behavior seen in adjacent Web3 typosquat campaigns (TrapDoor, `@mysten/*` prior waves)
- **Cluster B - Tinkoff BNPL Dolyame dep-confusion tail (1 npm package, 2026-08-17)**: `bnpl-blocks-independent-bnpl-search@>=0` (GHSA-v43r-98qv-2v96) continues the massive Tinkoff Bank (JSC Tinkoff, one of Russia's largest banks) internal-namespace dep-confusion burst catalogued 2026-08-05 (`bnpl-blocks-atom-bnpl-*`, `dolyame-boxy-*`, `tramvai-*`, `tinkoff-statist-*`), 2026-08-06, and 2026-08-08 (`bnpl-blocks-desktop-bnpl-anchor-title`). The `bnpl-blocks-independent-bnpl-*` sub-cluster matches the pattern of the internal Tinkoff Dolyame BNPL React component library. Any Tinkoff developer or CI runner whose `.npmrc` scope precedence misresolved to the public registry could have pulled the malicious version
- **Cluster C - LEB128 encoding typosquat pair (2 npm packages, 2026-08-17/18)**: `leb128x@>=0` (GHSA-p98p-7p39-8v79, 08-17) and `ulebkit@>=0` (GHSA-w4vj-4cxr-299x, 08-18) both target the LEB128 (Little Endian Base 128) variable-length integer encoding namespace used in WebAssembly, DWARF debug info, and the **Move / Sui BCS serialization stack**. `ulebkit` is the ULEB128 (unsigned LEB128) variant. The same-week overlap with the Sui typosquat cluster suggests one operator running a coordinated Move/WASM-adjacent naming sweep - LEB128 is a foundational primitive imported by BCS codecs and Move VM tooling
- **Cluster D - Generic CWE-506 boilerplate misc (2 npm packages, 2026-08-18)**: `blastradar@>=0` (GHSA-pp9x-4g56-7322) and `runtime-health@versions 1.0.1, 1.0.2, 1.0.4` (GHSA-fg74-5f33-c553, OpenSSF-flagged with source hash `947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832`). `blastradar` name may confuse with the legitimate BlastRadar production-risk scanner (unrelated npm package). `runtime-health` executes commands associated with malicious behavior per OpenSSF Package Analysis - the version fingerprint (1.0.1/1.0.2/1.0.4 with 1.0.3 missing) suggests a mid-cycle takedown / re-publish loop
- **Cluster E - PyPI Telegram-bot RAT trio (3 PyPI packages, 2026-08-18; extended 2026-08-19)**: `socks5901@1.0.0` (GHSA-3rcw-hq5f-gvrg, hash `e6184fc1…3e7dd3`) exfiltrates ALL files from `/sdcard/` at import time via a Telegram Bot API webhook, explicitly targeting Android hosts running Python (Termux, QPython, Pydroid). `infogram-bot@1.0.0..1.9.0` (GHSA-22rg-qv4f-2j3p, hash `454fa329…332cb0`, 11 versions) provides full Telegram-based remote access, file/credential exfil, persistence, and native-code extensions - the advisory states the package was "deliberately created and used to hack other machines". `httpz-requests@1.8.0..1.21.5` (GHSA-pm38-ccxh-j59w, hash `38eff923…5769a2`, 20 versions) is the sibling `requests`-typosquat implementation of the same Telegram-RAT toolchain. All three converge on the Telegram Bot API as their control/exfil channel; `api.telegram.org` is allow-listed on most home ISPs and mobile carriers, and the operator can rotate the bot token / channel without republishing. Any host that imported any of the three should be treated as attacker-controlled; secrets, `/sdcard/` contents, Telegram sessions, and browser cookies must be considered leaked

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for the 11 package names below
2. **For Cluster A matches (Sui typosquats)**: uninstall each match, correct to the real `@mysten/sui`, `@mysten/sui/graphql`, `@mysten/bcs`, or `@Bucket-Protocol/bucket-protocol-sdk` package. Given the multi-day Sui typosquat continuation (08-11, 08-12, and now 08-17/18), any Sui / Move / DeFi developer host that installed any of these should have wallet keystores, Sui / Aptos / Solana keys, and Cursor/Claude Code credentials rotated. Audit for TrapDoor-style hidden `CLAUDE.md` / `.cursorrules` prompt-injection artifacts left behind by adjacent Sui-targeted campaigns
3. **For Cluster B match (`bnpl-blocks-independent-bnpl-search`)**: Tinkoff Bank / Dolyame BNPL / adjacent-scope developers - audit `.npmrc` scope precedence; internal packages should resolve exclusively via the private registry. Rotate any credential shipped through a CI runner that installed this. Review the full 08-05 / 08-06 / 08-08 Tinkoff cluster (`bnpl-blocks-atom-*`, `dolyame-boxy-*`, `tramvai-*`, `tinkoff-statist-*`) for any additional local matches
4. **For Cluster C matches (LEB128 typosquats)**: uninstall and correct to the intended real package (`leb128`, `@thi.ng/leb128`, or the built-in BCS codec from `@mysten/bcs`). If used in a BCS/Move codepath alongside a Sui project, treat as high-priority - the operator overlap with Cluster A is likely deliberate
5. **For Cluster D matches (`blastradar`, `runtime-health`)**: uninstall. For `runtime-health` matches, the OpenSSF-published source hash `947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832` can be used to identify the malicious tarball in caches or CI logs. Because the payload description is only "executes commands associated with malicious behavior" without specifics, rotate anything the install host could reach and reimage build runners
6. **For Cluster E matches (`socks5901`, `infogram-bot`, `httpz-requests` PyPI Telegram-RAT trio)**: uninstall from any Python virtualenv - importantly for `socks5901`, check Termux / QPython / Pydroid installations on Android devices as well as standard Linux/Windows/macOS installs. For `infogram-bot` and `httpz-requests`, treat the install host as fully compromised: rotate every credential the host could reach, reimage build runners, and revoke any Telegram session tokens the host may have held. If `socks5901` was ever imported on an Android device, assume all files in `/sdcard/` have been leaked to a third party (photos, backups, downloaded documents, mnemonic backups, exported KeyStore files, screenshots of 2FA codes). The Telegram Bot API webhooks in the OpenSSF samples can be reported to Telegram's abuse team for token/channel takedown
7. For all npm installs in CI, run with `--ignore-scripts` as defence-in-depth. For all `pip install` runs, prefer `--only-binary=:all:` where feasible to skip `setup.py` execution
8. Verify none of the 11 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xgmm-vq93-f5vx - sui-move-graphql (Sui @mysten/* typosquat continuation day 5)](https://github.com/advisories/GHSA-xgmm-vq93-f5vx) - GitHub
- [GHSA-342c-493g-f389 - sui-move-rpc (Sui @mysten/* typosquat continuation day 4)](https://github.com/advisories/GHSA-342c-493g-f389) - GitHub
- [GHSA-rg66-wjvq-h8xm - sui-gql-core (Sui @mysten/* typosquat continuation day 4)](https://github.com/advisories/GHSA-rg66-wjvq-h8xm) - GitHub
- [GHSA-5w7j-92p9-p5h4 - bcs-core (Sui @mysten/bcs typosquat continuation day 4)](https://github.com/advisories/GHSA-5w7j-92p9-p5h4) - GitHub
- [GHSA-23pf-2cqf-xh64 - bucket-protocol-sdk-v2 (Sui DeFi @Bucket-Protocol/bucket-protocol-sdk typosquat)](https://github.com/advisories/GHSA-23pf-2cqf-xh64) - GitHub
- [GHSA-v43r-98qv-2v96 - bnpl-blocks-independent-bnpl-search (Tinkoff Dolyame BNPL dep-confusion tail)](https://github.com/advisories/GHSA-v43r-98qv-2v96) - GitHub
- [GHSA-p98p-7p39-8v79 - leb128x (LEB128 encoding typosquat)](https://github.com/advisories/GHSA-p98p-7p39-8v79) - GitHub
- [GHSA-w4vj-4cxr-299x - ulebkit (ULEB128 encoding typosquat)](https://github.com/advisories/GHSA-w4vj-4cxr-299x) - GitHub
- [GHSA-pp9x-4g56-7322 - blastradar (generic CWE-506)](https://github.com/advisories/GHSA-pp9x-4g56-7322) - GitHub
- [GHSA-fg74-5f33-c553 - runtime-health (OpenSSF Package Analysis: executes malicious commands)](https://github.com/advisories/GHSA-fg74-5f33-c553) - GitHub
- [GHSA-3rcw-hq5f-gvrg - socks5901 (PyPI Android /sdcard/ Telegram-bot file exfiltrator)](https://github.com/advisories/GHSA-3rcw-hq5f-gvrg) - GitHub
- [GHSA-22rg-qv4f-2j3p - infogram-bot (PyPI Telegram-bot RAT, 11 versions)](https://github.com/advisories/GHSA-22rg-qv4f-2j3p) - GitHub
- [GHSA-pm38-ccxh-j59w - httpz-requests (PyPI Telegram-RAT, 20 versions)](https://github.com/advisories/GHSA-pm38-ccxh-j59w) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).