# GitHub Advisory malware sweep, 19 August 2026

> 28 GHSA CWE-506 advisories in the 24h ending 2026-08-19 06:00 UTC. Headline: **Sui `@mysten/*` typosquat day 6** (`sui-graphql-rpc`, `sui-gql-rpc`) with a **targeted git-config allowlist** payload - dormant in CI, only fires for hardcoded developer identities. Also: 4-package Chinese exam-cheat surveillance, `jsonspack` pino-typosquat revival, and a PyPI deepface Telegram-session stealer.

- Published: 2026-08-19
- Last updated: 2026-08-20
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 29 packages, 42 compromised versions
- Tags: typosquat, dependency-confusion, crypto-wallet-drain, infostealer, credential-theft, obfuscation, dns-exfiltration
- Also known as: 2026-08-19 GHSA sweep, Sui @mysten typosquat register day 6, jsonspack pino-typosquat revival, Chinese exam-cheat surveillance suite, PyPI deepface Telegram-session stealer
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193
- Incident ID: multi-2026-08-19-ghsa-malware-sweep

## Affected packages (29)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@lilsccott6x9/devpipe-connector](https://dependencywatch.io/package/npm/@lilsccott6x9/devpipe-connector) | npm | 1.0.0 |
| [@sarex-team/sdk-js](https://dependencywatch.io/package/npm/@sarex-team/sdk-js) | npm | 9.9.11 |
| [@sarex-team/viewer](https://dependencywatch.io/package/npm/@sarex-team/viewer) | npm | 9.9.11 |
| [chai-as-gateway](https://dependencywatch.io/package/npm/chai-as-gateway) | npm | 7.1.5 |
| [chaikit](https://dependencywatch.io/package/npm/chaikit) | npm | 2.3.5 |
| [chameleon-src](https://dependencywatch.io/package/npm/chameleon-src) | npm | 6.6.29 |
| [deepface-weight](https://dependencywatch.io/package/pypi/deepface-weight) | PyPI | 0.1.4 |
| [deepface-weights](https://dependencywatch.io/package/pypi/deepface-weights) | PyPI | 0.1.0, 0.1.1, 0.1.2 |
| [reqcrypt](https://dependencywatch.io/package/pypi/reqcrypt) | PyPI | 0.1.0 |
| [reqcrypt-dev](https://dependencywatch.io/package/pypi/reqcrypt-dev) | PyPI | 0.1.0 |
| [solidity-hold](https://dependencywatch.io/package/npm/solidity-hold) | npm | 2.0.1 |
| [ssb-test-package](https://dependencywatch.io/package/npm/ssb-test-package) | npm | 1.0.0 |
| [streak-cal-core](https://dependencywatch.io/package/npm/streak-cal-core) | npm | 1.0.0 |
| [streak-key-lib](https://dependencywatch.io/package/npm/streak-key-lib) | npm | 1.0.0 |
| [sui-gql-rpc](https://dependencywatch.io/package/npm/sui-gql-rpc) | npm | 1.0.1 |
| [sui-graphql-rpc](https://dependencywatch.io/package/npm/sui-graphql-rpc) | npm | 1.0.1 |
| [sw-pluginer](https://dependencywatch.io/package/npm/sw-pluginer) | npm | 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0 |
| [syboy](https://dependencywatch.io/package/npm/syboy) | npm | 1.0.0 |
| [syjoy](https://dependencywatch.io/package/npm/syjoy) | npm | 1.0.0 |
| [sysc1](https://dependencywatch.io/package/npm/sysc1) | npm | 1.0.0, 1.0.1 |
| [sysdo](https://dependencywatch.io/package/npm/sysdo) | npm | 1.0.0 |
| [system-performance-helper](https://dependencywatch.io/package/npm/system-performance-helper) | npm | 1.0.0 |
| [table-ui-new](https://dependencywatch.io/package/npm/table-ui-new) | npm | 2.7.1, 2.7.2, 2.7.4, 2.7.5 |
| [tailwind-custom-templates](https://dependencywatch.io/package/npm/tailwind-custom-templates) | npm | 0.7.2 |
| [tfjs-custom-module](https://dependencywatch.io/package/npm/tfjs-custom-module) | npm | 1.0.0 |
| [timed-assess](https://dependencywatch.io/package/npm/timed-assess) | npm | 1.0.0, 1.0.1 |
| [twapfetch](https://dependencywatch.io/package/npm/twapfetch) | npm | 1.1.0, 1.1.1 |
| [txs-lib-sdk](https://dependencywatch.io/package/npm/txs-lib-sdk) | npm | 1.0.2 |
| [txs-runner-sdk](https://dependencywatch.io/package/npm/txs-runner-sdk) | npm | 1.0.0, 1.0.1 |

## What happened

The 24-hour window ending 2026-08-19 06:00 UTC published 28 new GHSA CWE-506 advisories (25 npm, 3 PyPI). This is one of the busiest daily sweeps of the month, and the day the multi-week Sui `@mysten/*` typosquat register **stops being boilerplate and turns targeted**.

## Cluster A - Sui `@mysten/*` typosquat continuation day 6, TARGETED (2 npm packages)

| Package | Versions | GHSA | OSV | Payload |
|---|---|---|---|---|
| `sui-graphql-rpc` | `1.0.1` | GHSA-rr7f-8h2g-c8rc | MAL-2026-14210 | Reads `~/.gitconfig`, derives encryption key from git identity, only runs payload for hardcoded developer allowlist |
| `sui-gql-rpc` | `1.0.1` | GHSA-4c65-5fr5-9xq3 | MAL-2026-14209 | Same shape: dormant in CI/sandboxes; conditional payload keyed on git identity |

This is a **material change from the day-4/5 boilerplate packages** ([08-18 sweep](https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep) Cluster A): those five carried the generic GHSA "assume host fully compromised" boilerplate with no per-package IOC, indicating either an early-warning takedown before the operator could deploy real payloads OR unfinished pre-staging packages. Days 6's two packages carry a **finished, targeted payload**: a git-config-based allowlist ensures the malware only executes for developers on the operator's target list, so:

- CI runners get nothing (no `~/.gitconfig` or an identity that does not match) — CI-scoped scanners miss it entirely.
- Sandboxes miss it — sandbox images typically have no git identity or a generic one.
- Untargeted developer workstations get nothing — the branch is dormant.
- **Only hosts whose developer git identity matches the operator's target list execute the payload.**

Because the target list is opaque, treat all install hosts as if in-scope until proven otherwise. This is the same pattern the [TrapDoor Sui/Move campaign](https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer) used in May: wallet keystore theft, Cursor/Claude Code credential exfil, and prompt-injection artifacts planted in `CLAUDE.md` / `.cursorrules`.

Multi-day Sui typosquat register timeline:

- 2026-08-11 (day 1): `sui-gql-client`, `sui-bcs-codec`
- 2026-08-12 (day 2): `sui-gql`, `bcs-compact`
- 2026-08-17 (day 4): `sui-move-rpc`, `sui-gql-core`, `bcs-core`, `bucket-protocol-sdk-v2`
- 2026-08-18 (day 5): `sui-move-graphql`
- **2026-08-19 (day 6): `sui-graphql-rpc`, `sui-gql-rpc` — this file, targeted**

## Cluster B - Chinese exam-cheat surveillance suite (4 npm packages)

| Package | GHSA | C2 endpoint | Behavior |
|---|---|---|---|
| `sysc1` | GHSA-w7f3-qj9q-xjcv | `new-pointer.vercel.app/api` | Silent Python 3.12 install, invisible overlay window, hidden hotkeys, screen capture, clipboard read, browser-content extraction |
| `syjoy` | GHSA-h63h-46qm-72xr | `new-pointer.vercel.app/api` | Same shape - full keyboard hook + screenshot + UI tree; C2 responds with commands executed via keyboard automation |
| `syboy` | GHSA-wwj3-8g39-3vf8 | (author-controlled, not per-advisory published) | VBS launcher, elevated Python install, clipboard + screenshot + accessibility tree exfil |
| `sysdo` | GHSA-h93v-w5cq-82r4 | `iq-sec.vercel.app/api` | Same as sibling - VBS launcher, silent Python 3.12.3 install, pyperclip/keyboard/mss/pyautogui payload, hidden console |

The four packages share a distinctive install shape: silently install Python 3.12 via Windows package managers with elevated privileges, deploy VBS launcher with hidden console, run global keyboard hooks + clipboard + screenshot + UI accessibility-tree extraction. Two C2 endpoints observed: `new-pointer.vercel.app/api` and `iq-sec.vercel.app/api` — both `.vercel.app` subdomains, cheap to rotate.

The combination of Windows package-manager installer, hidden overlay hotkey UI, keyboard automation-driven command execution, and UI-tree scraping matches the pattern of **online-proctored-exam cheating tools** (silently reads exam question text from the invigilator window into the operator agent, gets the answer, types it back via keyboard automation to make it look like the student typed it). The `sysc1` advisory explicitly calls out the "coordinated surveillance payload" characterization, and internal identifiers in the OpenSSF sample match the "exam" vocabulary.

## Cluster C - Pino logger typosquat / jsonspack revival (3 npm packages)

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `chai-as-gateway` | `<= 7.1.5` | GHSA-qwfr-cq2f-mc9p | ~4 MB obfuscator.io blob + RC4 decoder + 23k entries; import-time execution; AWS credential harvester over axios; publisher `hello@jsonspack.com` |
| `chaikit` | `<= 2.3.5` | GHSA-f9xv-p7pq-vmvg | Same shape - pino badges + 4 MB obfuscator blob; axios exfil |
| `solidity-hold` | `2.0.1` | GHSA-pv28-2qrf-2v4m | Same shape - pino README/badges + 4 MB obfuscator blob; axios in deps |

All three copy the pino README, badges, and metadata; all three carry an identical ~4 MB obfuscator.io payload with an RC4 decoder over 23,000+ encoded entries; publisher email `hello@jsonspack.com` matches the **[chai-as-persisted / jsonspack cluster catalogued 2026-06-27](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack)** exactly. The operator is back after ~7 weeks, running the same playbook with fresh package names.

Because the payload triggers on **import** (not postinstall), `npm install --ignore-scripts` does NOT block it - the moment any downstream code `require`s the fake logger, the obfuscator blob runs. Payload traverses `$HOME` for AWS credentials and exfils via HTTPS.

## Cluster D - Streak calendar sibling typosquat with ELF dropper (2 npm packages)

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `streak-key-lib` | `1.0.0` | GHSA-5vjc-7v47-9rh7 | ~65 KB obfuscated JS blob with RC4/XOR decoder; misleading header directs users to install "companion" packages |
| `streak-cal-core` | `1.0.0` | GHSA-8rg4-mc43-9c6p | **~500 KB base64-encoded x86-64 ELF binary** written to disk and spawned via `child_process`; Linux-only via ELF, dropper falls through on macOS/Windows |

Internal file headers reference `streak-larq-hydration` and `svelte-insight-hydration`; README points to `svelte-streak-cal`. The mismatched-name shape is a fingerprint of a **template-based typosquat family**: the operator has a template with a placeholder name and is minting sibling packages with slight variations. Expect further variants over the next few days (e.g. `streak-day-lib`, `streak-cal-hydration`).

## Cluster E - txs SDK Caesar loader pair (2 npm packages)

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `txs-runner-sdk` | `<= 1.0.1` | GHSA-4wc6-fvwc-gvqh | Payload hidden as `mark` field in JSON "product catalog" record; base64 + per-byte Caesar shift; indirect constructor lookup; axios + python-shell deps |
| `txs-lib-sdk` | `1.0.2` | GHSA-2p34-9h9g-7wf4 | Same shape - reads `database.js` disguised as product catalog, extracts `mark` field, base64 + Caesar, arbitrary Node.js execution with full fs/network/child_process capability |

Naming (`txs-*-sdk`) targets Web3/Solana transaction-tooling developers who search for a "transactions SDK". Both use the same Caesar-cipher + indirect-constructor-lookup obfuscation technique - likely one operator, likely more `txs-*-sdk` siblings to come.

## Cluster F - @sarex-team DNS-exfil pair (2 npm packages)

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `@sarex-team/viewer` | `<= 9.9.11` | GHSA-xgp4-2rxm-62fh | Postinstall + on every require(): `dns.resolve4(<hex-encoded-recon>.oob.sl4x0.xyz)`; API names stored as hex byte arrays and reassembled with `String.fromCharCode` |
| `@sarex-team/sdk-js` | `<= 9.9.11` | GHSA-44g3-f495-wrr5 | Same shape, same destination host, same hex-reassembly trick |

The `@sarex-team/*` scope has no legitimate publishing history on public npm - the operator registered it recently and pushed straight to v9.9.11. That version stamp on a fresh scope reads as **prepared dep-confusion bait** against a private `@sarex-team/*` scope somewhere; any org whose `.npmrc` scope precedence misresolved a `@sarex-team/*` install to the public registry would have pulled these.

DNS exfil to `oob.sl4x0.xyz` resolves via the host resolver, so egress-only firewalls do NOT block it - a host with no direct outbound HTTP but a functioning DNS resolver still leaks `username + hostname + cwd + package-id + timestamp` to the operator on install and on every require().

## Cluster G - Miscellaneous single-purpose npm (10 packages)

| Package | Versions | GHSA | Behavior |
|---|---|---|---|
| `twapfetch` | `1.1.0`, `1.1.1` | GHSA-2p2j-mgv3-82vj | Polymarket Chainlink TWAP `TwapClient/fetchTwapOnce` typosquat; postinstall downloads unverified tarball from env-var URL and evals; ships fake "Kelly-stake math helpers" |
| `tfjs-custom-module` | `1.0.0` | GHSA-4ccr-vjmw-rf6f | `@tensorflow/tfjs` typosquat; postinstall recon (hostname, platform, arch, node version) to `8xq4kw5d.instances.poc.jchunt.top` |
| `table-ui-new` | `2.7.1`, `2.7.2`, `2.7.4`, `2.7.5` | GHSA-q6w5-mpgv-mc26 | React table typosquat; `dist/config.js` has module-level `HASHES` array of base64 strings that unconditionally `fetch()` from `everydaynodechecker-39147n.vercel.app` and `eval()` the response |
| `chameleon-src` | `6.6.29` | GHSA-4mhp-g6gh-v4q8 | Preinstall `verify.js` fetches host IP via Cloudflare trace, uploads to attacker Sentry project with `sendDefaultPii:true` (Sentry auto-captures IP/hostname/user under PII) |
| `system-performance-helper` | `1.0.0` | GHSA-fhpw-32cw-j76m | Reverse-shell backdoor via postinstall `install.js`: TCP socket + OS shell over `HOST="YOUR_PUBLIC_IP":PORT=4444` with auto-reconnect and keep-alive. Placeholder unfilled at publish - weaponized on next republish |
| `sw-pluginer` | `1.0.0`, `1.0.1`, `1.0.2`, `1.1.0`, `1.2.0` | GHSA-wp99-p72h-8pq6 | Tailwind service-worker plugin typosquat; reads URL from staged `node_modules/.bin/manifest.json`, HTTP GET, eval - build-time RCE |
| `timed-assess` | `1.0.0`, `1.0.1` | GHSA-pw97-8f4h-8j38 | Postinstall reads bundled file, DES-decrypts with hardcoded key, pipes plaintext to detached spawn stdin - executes attacker JavaScript silently |
| `tailwind-custom-templates` | `<= 0.7.2` | GHSA-7fqm-rw2q-w45v | Tailwind Forms verbatim + appended obfuscator.io payload; hardcoded ETH wallet `0xa322E5f3…`; Ethereum RPC + block-explorer refs - wallet-drain or clipper C2 |
| `@lilsccott6x9/devpipe-connector` | `1.0.0` | GHSA-98w6-6qqf-q39g | Base64 postinstall via `child_process.execSync` writes `WebMCP-RCE-CANARY` to Desktop on Windows + Unix - shape is a research canary but a weaponizable postinstall RCE if repurposed |
| `ssb-test-package` | `1.0.0` | GHSA-395g-xx9j-mgx7 | Dep-confusion PoC; preinstall collects OS user + hostname + platform + network interfaces and writes JSON locally (no network exfil yet, but preinstall RCE confirmed) |

## Cluster H - PyPI (3 packages)

| Package | Versions | GHSA | Payload |
|---|---|---|---|
| `deepface-weight` | `0.1.4` | GHSA-5j48-33h2-gvwg | `deepface` face-recognition typosquat; background daemon polls for `data/telethon_market_userbot.session` and other Telegram sessions, exfils to Telegram Bot API webhook - **Telegram account takeover** |
| `deepface-weights` | `0.1.0`, `0.1.1`, `0.1.2` | GHSA-2cw8-w83p-pj7v | Sibling typosquat, same behavior; polls every 10s for the same telethon session file |
| `reqcrypt` | `0.1.0` | GHSA-m6gg-ffj5-fxqh | HTTP-client backdoor; `_process_response` on every HTTP verb decodes `payloaddd`/`payload_gz`/`payload_zlib` response fields and `exec()`s them - **any attacker-controlled HTTP response = RCE**; campaign `2026-08-reqcrypt` |
| `reqcrypt-dev` | `0.1.0` | GHSA-f4gc-vf6c-945w | **Sibling added 2026-08-20**; same `2026-08-reqcrypt` campaign, same HTTP-response `exec()` backdoor; hash `8e66755912...f3e4` - operator re-registered under `-dev` suffix to survive the reqcrypt takedown |

`deepface-weight` and `deepface-weights` share the same publisher metadata pattern (placeholder author `asdqwdasdqwdasd`, disposable email); both target ML/computer-vision developers importing what they think is a weight-file bundle. The Telegram-session-file focus (`telethon_market_userbot.session`) suggests a specific downstream operator running a Telegram-based market/trading bot that they want to hijack.

`reqcrypt` is the standout: because the backdoor triggers **on HTTP response content** (not on install, not on import - on the *response* to any call made using the library), it turns any downstream service that uses `reqcrypt` as an HTTP client into a remote-exec target for anyone who controls or can influence an endpoint that service calls. A Man-in-the-Middle or a compromised upstream = full RCE on every reqcrypt consumer.

## Registry state

All 28 packages yanked from their respective registries (npm, PyPI) during the takedown windows on 2026-08-19. `httpz-requests` PyPI simple index is empty (quarantined) - private mirrors that cached tarballs before takedown will keep serving them.

## Related tracked activity

- **Sui/Move typosquat multi-day campaign** (Cluster A): now on day 6, with a targeted git-config allowlist payload replacing earlier boilerplate. See [08-18 sweep](https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep) Cluster A for days 4-5 and [TrapDoor](https://dependencywatch.io/incident/multi-2026-05-22-trapdoor-crypto-stealer) for the upstream Sui/Move wallet-keystore stealer.
- **jsonspack pino-typosquat operator** (Cluster C): return after ~7 weeks; the [2026-06-27 chai-as-persisted / jsonspack](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack) file has the operator's publisher fingerprint.
- **Chinese exam-cheat surveillance** (Cluster B): first appearance of this shape in the ingest run - Windows PM install + VBS launcher + hidden overlay + accessibility-tree scraping is a distinctive fingerprint.
- **Telegram-based exfil / RAT** (Cluster H `deepface-*`): continues the pattern of the [08-18 PyPI Telegram-RAT trio](https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep) (Cluster E: `socks5901`, `infogram-bot`, `httpz-requests`). Different targets (Android files vs Telegram session files) but same channel choice - `api.telegram.org` egress being allow-listed almost everywhere.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193`. No named threat actor.

## Impact

- **Cluster A - Sui `@mysten/*` typosquat continuation day 6, TARGETED (2 npm packages, 2026-08-19)**: `sui-graphql-rpc@1.0.1` (GHSA-rr7f-8h2g-c8rc, OpenSSF hash `ba4994f544d3df11fa82980f25dc29e379f25a3e03fdbf9a448e995a75ac76a7`, OSV `MAL-2026-14210`) and `sui-gql-rpc@1.0.1` (GHSA-4c65-5fr5-9xq3, hash `12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33`, `MAL-2026-14209`). Unlike the boilerplate day-4/5 packages, these two carry a **git-config allowlist payload**: on import, the malware reads `~/.gitconfig`, derives an encryption key from the developer's git identity, and only decrypts + runs its second-stage payload when the identity matches a hardcoded target list. **Dormant in CI, sandboxes, and untargeted developer hosts** - detection scanners that only run in CI will not fire. Continues the multi-day Sui typosquat register: day 1 (08-11: `sui-gql-client`, `sui-bcs-codec`), day 2 (08-12: `sui-gql`, `bcs-compact`), days 4-5 (08-17/18: `sui-move-rpc`, `sui-gql-core`, `bcs-core`, `bucket-protocol-sdk-v2`, `sui-move-graphql`)
- **Cluster B - Chinese exam-cheat surveillance suite (4 npm packages, 2026-08-19)**: `sysc1@1.0.0,1.0.1` (GHSA-w7f3-qj9q-xjcv, hash `2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f`), `syjoy@1.0.0` (GHSA-h63h-46qm-72xr, hash `d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529`), `syboy@1.0.0` (GHSA-wwj3-8g39-3vf8, hash `f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7`), `sysdo@1.0.0` (GHSA-h93v-w5cq-82r4, hash `bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33`). All four silently install Python 3.12 via Windows package managers with elevated privileges, deploy VBS launchers, then run a hidden overlay window with global keyboard hooks, clipboard monitoring, screenshot capture, and UI-tree accessibility scraping. Two C2 endpoints observed: `new-pointer.vercel.app/api` (sysc1, syjoy) and `iq-sec.vercel.app/api` (sysdo). The Windows package-manager installer choice, hidden-overlay hotkey UI, and UI-tree scraping match the pattern of Chinese online-proctored-exam cheating tools (surreptitiously reads exam question text from the invigilator window and pastes prepared answers). Impact: keystroke exfil, credential harvest, remote input injection
- **Cluster C - Pino logger typosquat / jsonspack revival (3 npm packages, 2026-08-19)**: `chai-as-gateway@<=7.1.5` (GHSA-qwfr-cq2f-mc9p, hash `f90afdde9240783f1f869b875b7967490cf579e1bae0986861498f8c98c0d973`), `chaikit@<=2.3.5` (GHSA-f9xv-p7pq-vmvg, hash `a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4`), `solidity-hold@2.0.1` (GHSA-pv28-2qrf-2v4m, hash `39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f`). All three carry a ~4 MB obfuscator.io blob with an RC4 decoder and 23,000+ encoded entries; publisher email `hello@jsonspack.com` matches the [chai-as-persisted / jsonspack cluster catalogued 2026-06-27](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack). Payload traverses `$HOME` for AWS credentials and exfils via axios to attacker HTTP endpoint. All three copy pino badges and metadata. Because the payload triggers on **import** (not postinstall), `--ignore-scripts` does NOT stop this one
- **Cluster D - Streak calendar sibling typosquat with ELF dropper (2 npm packages, 2026-08-19)**: `streak-key-lib@1.0.0` (GHSA-5vjc-7v47-9rh7, hash `c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6`, ~65 KB obfuscated JS payload) and `streak-cal-core@1.0.0` (GHSA-8rg4-mc43-9c6p, hash `a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287`, **~500 KB base64-encoded x86-64 ELF binary written to disk and spawned via child_process**). Internal file headers reference `streak-larq-hydration` and `svelte-insight-hydration`; README points to `svelte-streak-cal`. Sibling naming shape indicates a template-based typosquat family, likely more variants to come. `streak-cal-core` is Linux-only via the ELF payload; on Windows/macOS the dropper falls through
- **Cluster E - txs SDK Caesar loader pair (2 npm packages, 2026-08-19)**: `txs-runner-sdk@<=1.0.1` (GHSA-4wc6-fvwc-gvqh, hash `db9d5d94b7f75bbe8bca33eb382bfb986e68b7f0307cad7e9626da103192f254`) and `txs-lib-sdk@1.0.2` (GHSA-2p34-9h9g-7wf4, hash `5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5`). Both hide their payload as a `mark` field in a JSON "product catalog" record, base64-decode + apply a per-byte Caesar shift, and eval via indirect constructor lookup. Dependencies include `axios` and `python-shell`, giving arbitrary Node.js and shell-out capability once triggered. Marketed as "random transaction data generator" (txs-runner-sdk) and "transactions helper" (txs-lib-sdk) - name shape suggests a Web3/Solana adjacent target
- **Cluster F - @sarex-team DNS-exfil pair (2 npm packages, 2026-08-19)**: `@sarex-team/viewer@<=9.9.11` (GHSA-xgp4-2rxm-62fh, hash `04b67de30d08d48f32be517383d6940c8179d2269ea7a1720346eacc2e8c28d5`) and `@sarex-team/sdk-js@<=9.9.11` (GHSA-44g3-f495-wrr5, hash `3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2`). Both scoped under an unfamiliar `@sarex-team/*` namespace, both exfil `username + hostname + cwd + package-id + timestamp` via DNS lookups to `oob.sl4x0.xyz` at install AND on every require(). API names (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`) and the destination host are stored as hex byte arrays and reassembled with `String.fromCharCode` to defeat string-based scanners. The v9.9.11 version stamp on a namespace with no legitimate publishing history reads as prepared dep-confusion bait against a private `@sarex-team/*` scope
- **Cluster G - Miscellaneous single-purpose npm (10 packages, 2026-08-19)**: `twapfetch@1.1.0,1.1.1` (Polymarket Chainlink TWAP typosquat, postinstall fetches remote tarball unverified and evals), `tfjs-custom-module@1.0.0` (TensorFlow.js `@tensorflow/tfjs` typosquat, postinstall recon to `8xq4kw5d.instances.poc.jchunt.top`), `table-ui-new@2.7.1,2.7.2,2.7.4,2.7.5` (React table typosquat, `HASHES` base64 array + eval() from `everydaynodechecker-39147n.vercel.app`), `chameleon-src@6.6.29` (preinstall `verify.js` collects IP + hostname + uploads to attacker Sentry project with `sendDefaultPii:true`), `system-performance-helper@1.0.0` (reverse-shell backdoor to `HOST=YOUR_PUBLIC_IP:4444` - placeholder unfilled at publish, weaponized on next republish), `sw-pluginer@1.0.0..1.2.0` (Tailwind service-worker plugin typosquat; reads URL from `node_modules/.bin/manifest.json`, HTTP GET, eval), `timed-assess@1.0.0,1.0.1` (postinstall DES-decrypts bundled payload with hardcoded key, spawns detached), `tailwind-custom-templates@<=0.7.2` (Tailwind Forms + obfuscator.io ETH wallet drain payload, hardcoded ETH addr `0xa322E5f3…`), `@lilsccott6x9/devpipe-connector@1.0.0` (base64 postinstall writes `WebMCP-RCE-CANARY` to Desktop; looks like a research canary but the shape is a weaponizable PoC), `ssb-test-package@1.0.0` (dep-confusion PoC recon via preinstall)
- **Cluster H - PyPI (3 packages, 2026-08-19)**: `deepface-weight@0.1.4` (GHSA-5j48-33h2-gvwg, hashes `6808b9ae…5f1a` / `92f87cc2…3e2b`) and `deepface-weights@0.1.0,0.1.1,0.1.2` (GHSA-2cw8-w83p-pj7v, hashes `9c1cf8a0…0558` / `a9b6a125…6fce`) both typosquat the popular `deepface` facial-recognition library; on import they spawn a background daemon that polls every 10s for `data/telethon_market_userbot.session` and other Telegram session files and exfils them to a Telegram Bot API webhook - **stolen sessions grant full Telegram account takeover**. `reqcrypt@0.1.0` (GHSA-m6gg-ffj5-fxqh, campaign `2026-08-reqcrypt`, hashes `152e5cdb…fb39` / `556f2178…4fb39`) is an HTTP-client backdoor: `_process_response` on every `get/post/put/delete/patch/download/upload` verb inspects the response for `payloaddd`/`payload_gz`/`payload_zlib` fields, decodes and `exec()`s them - **any attacker who can influence any HTTP response the app fetches gets RCE**. **Sibling added 2026-08-20**: `reqcrypt-dev@0.1.0` (GHSA-f4gc-vf6c-945w, hash `8e66755912c02a4de1ed6f86b092e2a0dcdadbcaef931cbd07c6d2306619f3e4`) is the same `2026-08-reqcrypt` campaign under a `-dev` suffix, same HTTP-response `exec()` backdoor - registered under a different package name to survive the reqcrypt takedown

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for the 28 package names below
2. **For Cluster A matches (Sui typosquat continuation day 6)**: uninstall, correct to `@mysten/sui/graphql` or the appropriate real `@mysten/*` package, and **rotate as if compromised even if your CI runs never triggered**. The git-config allowlist means the operator has a target list you cannot see; if the developer identity on any workstation that installed this matches the operator's list, wallet keystores, Sui / Aptos / Solana keys, Cursor/Claude Code credentials, and browser session cookies are already exfiltrated. Audit for TrapDoor-style hidden `CLAUDE.md` / `.cursorrules` prompt-injection artifacts. Review the parallel [08-18 sweep](https://dependencywatch.io/incident/multi-2026-08-18-ghsa-malware-sweep) and [08-11](https://dependencywatch.io/incident/npm-2026-08-11-ghsa-malware-sweep) / [08-12](https://dependencywatch.io/incident/npm-2026-08-12-ghsa-malware-sweep) entries for the earlier days of this register
3. **For Cluster B matches (Chinese exam-cheat surveillance)**: uninstall and reimage. Because Python was installed with elevated privileges and a hidden overlay/keyboard-hook agent was deployed, the host cannot be trusted after removal - the agent may auto-restart via VBS shortcut, scheduled task, or Startup folder. Reimage Windows hosts, then re-add missing exam-integrity tooling from vendor-signed installers. Block the domains `new-pointer.vercel.app` and `iq-sec.vercel.app` at the perimeter and via DNS RPZ
4. **For Cluster C matches (pino/jsonspack revival)**: uninstall, rotate every AWS credential the host could reach (this is an aggressive credential harvester). Correct to real `pino` from `pinojs/pino`. Note that `--ignore-scripts` does NOT block this cluster - triggers on import, not on postinstall. Any repo that pulled one of these needs a full CI secret rotation. Cross-reference the [2026-06-27 chai-as-persisted / jsonspack cluster](https://dependencywatch.io/incident/npm-2026-06-27-chai-as-persisted-jsonspack) - the operator is back after ~7 weeks
5. **For Cluster D matches (Streak calendar typosquats)**: uninstall. On Linux hosts that installed `streak-cal-core`, check `/tmp` and the current working directory for the dropped ELF binary and `ps -ef` for anomalous child processes - reimage build runners on any hit. Correct to the intended real `svelte-streak-cal` package if it exists; otherwise audit whether the calendar helper is worth the risk
6. **For Cluster E matches (txs SDK)**: uninstall. If any install ran, assume the attacker has full Node capability on the host and rotate credentials the host could reach; `python-shell` in the dep tree hints at Python-payload staging on the next release, so also audit for stray Python processes
7. **For Cluster F matches (`@sarex-team/*`)**: uninstall. Because DNS exfil resolves via the host resolver, egress-only firewalls do NOT block it - any host that install-ran these has already leaked its identity to `oob.sl4x0.xyz`. Rotate anything the leak of `username + hostname + cwd + package-id` would help an adversary target. If your org uses a private `@sarex-team/*` scope, correct your `.npmrc` scope precedence
8. **For Cluster G matches**: uninstall each. `chameleon-src`, `system-performance-helper`, `tailwind-custom-templates`, `timed-assess`, `sw-pluginer`, `twapfetch`, `tfjs-custom-module`, `table-ui-new` all trigger on install and would have delivered payload; rotate cloud credentials and reimage build runners on any hit. `@lilsccott6x9/devpipe-connector` is a research canary shape - if it appears in a production lockfile, treat as unauthorized and remove; a real dev-pipe connector should not write to Desktop
9. **For Cluster H matches (deepface* + reqcrypt PyPI)**: uninstall from every virtualenv. For `deepface-weight` / `deepface-weights` matches, **revoke all Telegram sessions from Telegram Settings → Devices** on any account whose `.session` file lived on the install host - the exfiltrated session grants full account takeover. For `reqcrypt` matches, the backdoor is triggered by response content, so any host that installed reqcrypt AND made HTTP calls to any endpoint an attacker could influence is compromised - rotate credentials, reimage the host, and audit outbound traffic for the base64-then-exec payload fingerprint
10. For all npm installs in CI, run with `--ignore-scripts` as defence-in-depth - but note it does NOT stop Cluster C (import-triggered) or Cluster F (require-triggered) - only postinstall lifecycle. For all `pip install` runs, prefer `--only-binary=:all:` where feasible to skip `setup.py` execution
11. Verify none of the 28 packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-rr7f-8h2g-c8rc - sui-graphql-rpc (Sui typosquat continuation day 6, targeted git-config allowlist)](https://github.com/advisories/GHSA-rr7f-8h2g-c8rc) - GitHub
- [GHSA-4c65-5fr5-9xq3 - sui-gql-rpc (Sui typosquat continuation day 6, targeted git-config allowlist)](https://github.com/advisories/GHSA-4c65-5fr5-9xq3) - GitHub
- [GHSA-w7f3-qj9q-xjcv - sysc1 (Chinese exam-cheat surveillance)](https://github.com/advisories/GHSA-w7f3-qj9q-xjcv) - GitHub
- [GHSA-h63h-46qm-72xr - syjoy (Chinese exam-cheat surveillance)](https://github.com/advisories/GHSA-h63h-46qm-72xr) - GitHub
- [GHSA-wwj3-8g39-3vf8 - syboy (Chinese exam-cheat surveillance)](https://github.com/advisories/GHSA-wwj3-8g39-3vf8) - GitHub
- [GHSA-h93v-w5cq-82r4 - sysdo (Chinese exam-cheat surveillance)](https://github.com/advisories/GHSA-h93v-w5cq-82r4) - GitHub
- [GHSA-qwfr-cq2f-mc9p - chai-as-gateway (jsonspack pino-typosquat revival)](https://github.com/advisories/GHSA-qwfr-cq2f-mc9p) - GitHub
- [GHSA-f9xv-p7pq-vmvg - chaikit (jsonspack pino-typosquat revival)](https://github.com/advisories/GHSA-f9xv-p7pq-vmvg) - GitHub
- [GHSA-pv28-2qrf-2v4m - solidity-hold (jsonspack pino-typosquat revival)](https://github.com/advisories/GHSA-pv28-2qrf-2v4m) - GitHub
- [GHSA-5vjc-7v47-9rh7 - streak-key-lib (Streak sibling typosquat)](https://github.com/advisories/GHSA-5vjc-7v47-9rh7) - GitHub
- [GHSA-8rg4-mc43-9c6p - streak-cal-core (Streak sibling with ELF dropper)](https://github.com/advisories/GHSA-8rg4-mc43-9c6p) - GitHub
- [GHSA-4wc6-fvwc-gvqh - txs-runner-sdk (Caesar-loader SDK typosquat)](https://github.com/advisories/GHSA-4wc6-fvwc-gvqh) - GitHub
- [GHSA-2p34-9h9g-7wf4 - txs-lib-sdk (Caesar-loader SDK typosquat)](https://github.com/advisories/GHSA-2p34-9h9g-7wf4) - GitHub
- [GHSA-xgp4-2rxm-62fh - @sarex-team/viewer (DNS-exfil to oob.sl4x0.xyz)](https://github.com/advisories/GHSA-xgp4-2rxm-62fh) - GitHub
- [GHSA-44g3-f495-wrr5 - @sarex-team/sdk-js (DNS-exfil to oob.sl4x0.xyz)](https://github.com/advisories/GHSA-44g3-f495-wrr5) - GitHub
- [GHSA-2p2j-mgv3-82vj - twapfetch (Polymarket Chainlink TWAP typosquat)](https://github.com/advisories/GHSA-2p2j-mgv3-82vj) - GitHub
- [GHSA-4ccr-vjmw-rf6f - tfjs-custom-module (TensorFlow.js typosquat)](https://github.com/advisories/GHSA-4ccr-vjmw-rf6f) - GitHub
- [GHSA-q6w5-mpgv-mc26 - table-ui-new (React table typosquat, HASHES eval-loader)](https://github.com/advisories/GHSA-q6w5-mpgv-mc26) - GitHub
- [GHSA-4mhp-g6gh-v4q8 - chameleon-src (Sentry-PII covert exfil)](https://github.com/advisories/GHSA-4mhp-g6gh-v4q8) - GitHub
- [GHSA-fhpw-32cw-j76m - system-performance-helper (reverse shell)](https://github.com/advisories/GHSA-fhpw-32cw-j76m) - GitHub
- [GHSA-wp99-p72h-8pq6 - sw-pluginer (Tailwind SW plugin typosquat, build-time eval)](https://github.com/advisories/GHSA-wp99-p72h-8pq6) - GitHub
- [GHSA-pw97-8f4h-8j38 - timed-assess (postinstall DES-decrypted spawn)](https://github.com/advisories/GHSA-pw97-8f4h-8j38) - GitHub
- [GHSA-7fqm-rw2q-w45v - tailwind-custom-templates (Tailwind Forms typosquat + ETH wallet-drain)](https://github.com/advisories/GHSA-7fqm-rw2q-w45v) - GitHub
- [GHSA-98w6-6qqf-q39g - @lilsccott6x9/devpipe-connector (WebMCP-RCE-CANARY)](https://github.com/advisories/GHSA-98w6-6qqf-q39g) - GitHub
- [GHSA-395g-xx9j-mgx7 - ssb-test-package (dep-confusion PoC)](https://github.com/advisories/GHSA-395g-xx9j-mgx7) - GitHub
- [GHSA-5j48-33h2-gvwg - deepface-weight (Telegram-session exfil)](https://github.com/advisories/GHSA-5j48-33h2-gvwg) - GitHub
- [GHSA-2cw8-w83p-pj7v - deepface-weights (Telegram-session exfil)](https://github.com/advisories/GHSA-2cw8-w83p-pj7v) - GitHub
- [GHSA-m6gg-ffj5-fxqh - reqcrypt (HTTP-response backdoor, exec of payloaddd/gz/zlib)](https://github.com/advisories/GHSA-m6gg-ffj5-fxqh) - GitHub
- [GHSA-f4gc-vf6c-945w - reqcrypt-dev (2026-08-reqcrypt campaign sibling, added 2026-08-20)](https://github.com/advisories/GHSA-f4gc-vf6c-945w) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).