# GitHub Advisory malware sweep, 23 August 2026

> 20 new GHSA CWE-506 advisories in the 24h ending 2026-08-23. Highlights: `@syncraft-labs/{core,react,vue}` uses **Ethereum-blockchain dead-drop C2** (EtherHiding); five `N-*-sight-web` packages fetch mutable Bitbucket payloads; four pino-impersonators pull from `jsonstorage.net`; `totp-utils` drops a Minecraft mod JAR + steals Discord tokens.

- Published: 2026-08-23
- Last updated: 2026-08-24
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 23 packages, 37 compromised versions
- Tags: dependency-confusion, infostealer, credential-theft, typosquat, obfuscation, dns-exfiltration, ci-cd-compromise, cdn-supply-chain
- Also known as: 2026-08-23 GHSA sweep, @syncraft-labs EtherHiding cluster, N-sight-web bitbucket dropper family, pino impersonator testing-utils/testkit cluster, stillm4ddpocs oast.fun DNS dep-confusion cluster, totp-utils Minecraft Fabric JAR dropper, create-coin esbuild netbsd-x64 typosquat, @usaa-grp USAA dep-confusion, scrambleeeer 2026-08-scrambleeer sixth variant, libasync 2026-08-libasync miner
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, bad-packages.kam193.eu
- Incident ID: multi-2026-08-23-ghsa-malware-sweep

## Affected packages (23)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@syncraft-labs/core](https://dependencywatch.io/package/npm/@syncraft-labs/core) | npm | 0.4.1 |
| [@syncraft-labs/react](https://dependencywatch.io/package/npm/@syncraft-labs/react) | npm | 0.4.1 |
| [@syncraft-labs/vue](https://dependencywatch.io/package/npm/@syncraft-labs/vue) | npm | 0.4.1 |
| [@usaa-grp-personal-profile/personal-profile-common](https://dependencywatch.io/package/npm/@usaa-grp-personal-profile/personal-profile-common) | npm | 999.0.0 |
| [10-shardsight-web](https://dependencywatch.io/package/npm/10-shardsight-web) | npm | 1.0.0, 1.0.1 |
| [2-loadsight-web](https://dependencywatch.io/package/npm/2-loadsight-web) | npm | 1.0.0, 1.0.1 |
| [3-buildsight-web](https://dependencywatch.io/package/npm/3-buildsight-web) | npm | 1.0.0, 1.0.1 |
| [6-viewsight-web](https://dependencywatch.io/package/npm/6-viewsight-web) | npm | 1.0.0, 1.0.1 |
| [8-fetchsight-web](https://dependencywatch.io/package/npm/8-fetchsight-web) | npm | 1.0.0, 1.0.1 |
| [chai-as-testkit](https://dependencywatch.io/package/npm/chai-as-testkit) | npm | 2.3.5 |
| [create-coin](https://dependencywatch.io/package/npm/create-coin) | npm |  |
| [hatdhat-testkit](https://dependencywatch.io/package/npm/hatdhat-testkit) | npm | 3.2.14 |
| [internallib_v902](https://dependencywatch.io/package/npm/internallib_v902) | npm |  |
| [libasync](https://dependencywatch.io/package/pypi/libasync) | PyPI | 1.0.0 |
| [rust-testing-utils](https://dependencywatch.io/package/npm/rust-testing-utils) | npm | 2.3.0 |
| [scrambleeeer](https://dependencywatch.io/package/pypi/scrambleeeer) | PyPI | 0.1.0 |
| [solidity-testing-utils](https://dependencywatch.io/package/npm/solidity-testing-utils) | npm | 1.2.0 |
| [stillm4ddpocs-demo-gadget](https://dependencywatch.io/package/npm/stillm4ddpocs-demo-gadget) | npm | 999.9.10, 999.9.12, 999.9.20 |
| [stillm4ddpocs-demo-sprocket](https://dependencywatch.io/package/npm/stillm4ddpocs-demo-sprocket) | npm | 999.9.12 |
| [stillm4ddpocs-demo-widget](https://dependencywatch.io/package/npm/stillm4ddpocs-demo-widget) | npm | 999.9.9 |
| [stillm4ddpocs-rtest-alpha](https://dependencywatch.io/package/npm/stillm4ddpocs-rtest-alpha) | npm | 999.9.9, 999.9.10 |
| [stillm4ddpocs-rtest-bravo](https://dependencywatch.io/package/npm/stillm4ddpocs-rtest-bravo) | npm | 999.9.9, 999.9.10 |
| [totp-utils](https://dependencywatch.io/package/npm/totp-utils) | npm | 1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9 |

## What happened

The 24-hour window ending 2026-08-23 06:00 UTC published **18 new GHSA CWE-506 advisories on npm** and **2 on PyPI**. Two things about this batch matter beyond the usual sweep noise: (1) the `@syncraft-labs/*` trio uses **Ethereum-blockchain dead-drop C2** (the EtherHiding pattern that ChainDrop debuted three weeks ago at scale) as a standalone dropper — the technique is now becoming a template for smaller-catchment operators; (2) five `N-*-sight-web` siblings run an XSS-by-design payload from an unpinned Bitbucket branch, so any frontend that shipped them ran attacker JavaScript in the host page origin for the entire deploy window.

## Cluster A - npm `@syncraft-labs/{core,react,vue}` EtherHiding blockchain-C2 dropper (3 packages)

| Package | Versions | GHSA | Hash |
|---|---|---|---|
| `@syncraft-labs/core` | `<=0.4.1` | GHSA-54xx-8x72-3539 | `0efe2190…d4ac` |
| `@syncraft-labs/react` | `<=0.4.1` | GHSA-83j7-x5xf-qxwq | `c3986bd0…5cb9` |
| `@syncraft-labs/vue` | `<=0.4.1` | GHSA-9cqm-9mxm-f9gh | `d78f2856…065f` |

All three share the operator address `0xa322E5f3…` on Ethereum mainnet and the same RPC candidate list (`eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blockscout.com`, `1rpc.io/eth`, Blockscout, Etherscan-shape `txlist` endpoints). Only the **ESM `dist/index.js`** is tampered — TypeScript sources and the CommonJS build are clean, which means a routine `git diff` on the published artefacts misses the payload entirely. The injected code hides behind a fake `isDevMode()` helper: it captures `require`/`module`/`__filename` onto `globalThis`, pulls transaction call-data from the attacker address, zlib-decompresses it, and `child_process.spawn`s the resulting JavaScript. Because the payload lives in a mutable smart-contract dead-drop, the operator can rotate payloads without republishing a single package, and the C2 endpoint set can be widened to any public Ethereum RPC. This is the **standalone-dropper flavour** of the same technique the ChainDrop worm ([2026-08-04](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable)) used inside a worming keyv/cacheable payload — EtherHiding is now graduating from a headline research pattern into a reusable template.

## Cluster B - npm `N-*-sight-web` mutable-Bitbucket dropper (5 packages)

| Package | Versions | GHSA | Hash |
|---|---|---|---|
| `2-loadsight-web` | `1.0.0, 1.0.1` | GHSA-4f5v-fg99-x9xc | `cae23fe6…c08b5` |
| `3-buildsight-web` | `1.0.0, 1.0.1` | GHSA-p6pp-6xxg-295v | `ed2d8b62…5545` |
| `6-viewsight-web` | `1.0.0, 1.0.1` | GHSA-g8jq-29p5-5qrp | `96501ebb…6e68` |
| `8-fetchsight-web` | `1.0.0, 1.0.1` | GHSA-6wj3-8mh4-prqm | `d0e6a4c6…f549` |
| `10-shardsight-web` | `1.0.0, 1.0.1` | GHSA-6fq4-5r9g-9gfh | `4c7da642…4555` |

All five are the same package under different numeric prefixes (`2-`, `3-`, `6-`, `8-`, `10-`), pointing at the same C2: `https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight`. The operator did not bother varying the URL — five siblings hit one endpoint. On module load, a top-level async IIFE fetches the HTML, splats it into `document.head`/`document.body`, then re-creates every `<script>` element as a live script tag so the browser executes it in the host page origin. The Bitbucket workspace `p2p-alt-public` is unaffiliated with any legitimate publisher and the `main` branch is unpinned — the operator can push new JavaScript at any time and every deployed frontend that shipped these packages will run it on the next page load with no republish. This is **runtime browser-side XSS by design**, not install-time backdoor: `--ignore-scripts` does not help, and a `git audit` of the bundle only shows a small `fetch()` call.

## Cluster C - npm pino-impersonator `*-testing-utils`/`*-testkit` jsonstorage.net dropper (4 packages)

| Package | Versions | GHSA | Hash | Shape |
|---|---|---|---|---|
| `rust-testing-utils` | `2.3.0` | GHSA-mgfq-rgcw-ff87 | `ee33bded…ffa65` | detached child + Function() |
| `solidity-testing-utils` | `1.2.0` | GHSA-g5g4-w6x5-58j4 | `7a7ffd7d…f3bd8` | detached child + Function() |
| `hatdhat-testkit` | `<=3.2.14` | GHSA-3ghm-p4g2-9r6p | `83b6e58e…46d9` | detached child + Function() |
| `chai-as-testkit` | `<=2.3.5` | GHSA-4wfj-hpq9-58mw | `0bf8ab4a…cec31` | 4MB CFF bundle, no lazy path |

All four impersonate the legitimate `pino` logging library — README copied verbatim, source tree cloned, fraudulent author `Robert King, hello@jsonspack.com`. The first three share one C2: `index.js` spawns `lib/caller.js` as a detached child process; caller.js base64-decodes an embedded URL to `https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f`, POSTs with an `x-secret-key` header, and executes the returned JSON `cookie` field via `Function.constructor` — full `require()` access to the parent process. `chai-as-testkit` swaps that architecture for a single **4MB+ control-flow-flattened bundle** at `lib/config.js` that runs immediately on import, no lazy paths, no network round trip needed to compromise. The `jsonstorage.net` endpoint is a **mutable public keyed store** — the operator can rewrite the payload without republishing any package.

## Cluster D - npm `stillm4ddpocs-*` oast.fun DNS-tunnel dep-confusion beacon (5 packages)

| Package | Versions | GHSA | Hash | Published |
|---|---|---|---|---|
| `stillm4ddpocs-demo-sprocket` | `999.9.12` | GHSA-6cpg-8367-hp87 | `f71ba0f8…4e2b` | 2026-08-23 |
| `stillm4ddpocs-rtest-alpha` | `999.9.9, 999.9.10` | GHSA-mrj6-mc6j-fpcm | `47545f80…3839` | 2026-08-23 |
| `stillm4ddpocs-rtest-bravo` | `999.9.9, 999.9.10` | GHSA-j8vq-ph59-27pv | `15e4272b…f5f2` | 2026-08-23 |
| `stillm4ddpocs-demo-widget` | `999.9.9` | GHSA-ghqx-mmmj-m486 | `f71ba0f8…4e2b` | 2026-08-22 |
| `stillm4ddpocs-demo-gadget` | `999.9.10, 999.9.12, 999.9.20` | GHSA-452p-xh57-7mqp | `3ade0d32…85c6` | 2026-08-22 |

All five share the callback domain `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun` (interact.sh / Nuclei OAST public endpoint) and the fingerprint `999.9.x` dep-confusion sentinel version. `preinstall` runs a reconnaissance beacon that collects hostname, username, home directory, local IPv4, egress IP (via `api.ipify.org`, `icanhazip.com`, `ifconfig.me`), DNS resolver config, and consuming-project `package.json`. Exfil goes out **three** channels in parallel: HTTP POST/80, HTTPS POST/443, and DNS TXT lookups formatted as `<idx>-<chunk>.u-<uuid>.<callback>` with the payload hex-encoded and split into 60-char chunks. The DNS channel is deliberate — it defeats HTTP-only egress filtering by leaking through the recursive resolver. The `-widget`/`-gadget` variants use the same domain but publish minimal GHSA IOC data. The `still m4dd pocs` (as in "still mad" + PoC) framing plus README claims of "authorised security research" are **not** an out — the beacon fires on install without consent, and the same package can (and does) get pulled into unrelated builds via dep-confusion.

## Cluster E - npm `totp-utils` Minecraft JAR dropper + Discord/browser stealer (1 package)

| Package | Versions | GHSA | Hash |
|---|---|---|---|
| `totp-utils` | `1.4.2, 1.4.3, 1.4.4, 1.4.5, 1.4.6, 1.4.7, 1.4.8, 1.4.9` | GHSA-93j4-gp34-3h5m | `8cebaa0a…deeb5` |

Two separate infection paths that defeat `--ignore-scripts` alone: (1) a `postinstall` hook, (2) the advertised public API function `validateSecret()` also runs the payload — so any CI job or developer that called the API after installing with `--ignore-scripts` still tripped the payload. On execution the malware walks the Discord, Chrome, Edge, Brave, and Opera credential stores; it validates harvested Discord tokens against the real Discord API before exfil; and it exfils to a Discord webhook at `discord.com/api/webhooks/1532429233769419004/…`. Separately, it drops `optimized-renderer-1.0.0.jar` from `cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar` into the Minecraft mods directory; the JAR runs the **next** time the user launches Minecraft with Fabric loader, extending the compromise from a one-shot install to a lifestyle backdoor on gaming laptops. This is the **cross-audience** shape (dev laptop → gamer install of same laptop) that infostealer operators have been iterating toward for months.

## Cluster F - npm `create-coin` esbuild `netbsd-x64` typosquat + trycloudflare env exfil (1 package)

| Package | Versions | GHSA | Hash |
|---|---|---|---|
| `create-coin` | `<=20.1.1` | GHSA-468x-vgxv-xv9w | `d92da1d8…c380` |

`package.json` describes itself as a "netbsd-x64 build for esbuild", squatting on the esbuild platform-binary family (packages like `@esbuild/netbsd-x64` are official). `postinstall` runs `build/payload.node.js` which fingerprints the environment (CI/GitHub Actions/Docker/limited-env checks) and **skips if it looks like a sandbox** — a research-evasion tell. If it decides to run, it reads `~/.npmrc`, `package.json`, `package-lock.json`, `.env`, and `src/config.*`, enumerates hostname/user/open localhost ports, and POSTs the full `process.env` to `https://<random-name>.trycloudflare.com/` with TLS verification disabled. Idempotency marker `.ran` prevents re-firing. Randomised 10-30s delays defeat naïve timing correlation. Forces `exit 0` to mask any error a developer might notice.

## Cluster G - npm `@usaa-grp-personal-profile/personal-profile-common` USAA-targeted dep-confusion (1 package)

| Package | Versions | GHSA | Hash |
|---|---|---|---|
| `@usaa-grp-personal-profile/personal-profile-common` | `999.0.0` | GHSA-rh37-fc24-hw7w | `de7570e7…630a` |

Highly targeted: the scope `@usaa-grp-personal-profile` reads as USAA (the US bank/insurer) internal group name. The `999.0.0` version is the dep-confusion sentinel. `beacon.js` collects hostname/username/CWD, hex-encodes it into DNS labels, and exfils via DNS TXT queries to attacker-controlled `oastify.com` subdomains (Burp Collaborator public OAST). If USAA (or any org squatting a `@usaa-grp-*` scope) has a private package under this scope, the operator now has a confirmed catchment for a targeted follow-up payload.

## Cluster H - npm `internallib_v902` no-IOC dep-confusion pull (1 package)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `internallib_v902` | `>=0` | GHSA-3p65-4jqj-5j69 | No IOCs published; `internallib_*` naming continues the campaign in [/incident/multi-2026-08-19-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep) |

The `internallib_` prefix + numeric-suffix pattern matches the `internallib_*` guessing campaign already flagged in prior sweeps. Treat as full RCE against any private-registry proxy that ever fell through to public.

## Cluster I - PyPI `scrambleeeer` (four e's) fifth `scrambleeer/reqcrypt` sibling (1 package)

| Package | Versions | GHSA | Campaign | Hash |
|---|---|---|---|---|
| `scrambleeeer` | `0.1.0` | GHSA-xw2j-24j3-3282 | `2026-08-scrambleeer` | `52bcde49…d414` |

Same hardcoded reverse-shell payload as `scrambleeer` three e's (see [2026-08-22 sweep Cluster C](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep)). The **six-variant operator register** now spans: `reqcrypt` (Aug 19), `reqcrypt-dev` (Aug 20), `reqcrypts` (Aug 21), `requests-crypt` (Aug 22), `scrambleeer` (Aug 22), `scrambleeeer` (Aug 22). The operator started with suffix rotation (`-dev`, `s`), then went to prefix rotation (`requests-`), and is now on **letter-count mutation** (`scrambleeer` → `scrambleeeer` → next likely `scrambleeeeer`). Any scanner that tracked five names will miss the sixth; watch for `scrambleeeeer`, `screambler`, `reqcrypto`, and adjacent letter-shuffles.

## Cluster J - PyPI `libasync` cryptominer + registry-key persistence (1 package)

| Package | Versions | GHSA | Campaign | Hashes |
|---|---|---|---|---|
| `libasync` | `1.0.0` | GHSA-7vpc-7xx6-5v47 | `2026-08-libasync` (related `2026-07-pyqt6darktheme`) | `a46929f4…eb9c`, `11d7c6bd…a278`, `b7e770b7…c0d0` |

Installs a **native (C-extension) bootstrapper** that downloads a remote executable, establishes persistence via Windows registry keys under `Run`, and runs a cryptominer. Ships obfuscated code + sandbox-detection so the sample fights dynamic analysis. The upstream link to `2026-07-pyqt6darktheme` (already-known miner campaign) suggests the same operator running the same monetisation stack against a new package brand.

## Registry state

All 20 packages yanked from their respective registries during the 2026-08-23 takedown window. Private mirrors that cached tarballs before takedown will keep serving them.

## Related tracked activity

- **EtherHiding blockchain-C2 pattern** (Cluster A): first shipped at scale by the [ChainDrop worm on 2026-08-04](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable); now a standalone-dropper template.
- **`2026-08-reqcrypt`/`2026-08-scrambleeer` PyPI register** (Cluster I): now **six variants** across `reqcrypt`, `reqcrypt-dev`, `reqcrypts`, `requests-crypt`, `scrambleeer`, `scrambleeeer`. See the [2026-08-19](https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep), [2026-08-20](https://dependencywatch.io/incident/multi-2026-08-20-ghsa-malware-sweep), [2026-08-21](https://dependencywatch.io/incident/multi-2026-08-21-ghsa-malware-sweep), and [2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) sweeps for prior variants.
- **`internallib_*` dep-confusion register** (Cluster H): continuation of the campaign flagged in [/incident/multi-2026-08-19-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep).
- **`trycloudflare.com` short-lived-tunnel C2** (Cluster F): also seen in [`clx` DGA dropper (2026-07-01)](https://dependencywatch.io/incident/npm-2026-07-01-clx-cookie-dga-dropper).
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `bad-packages.kam193.eu`. No named threat actor.

## Impact

- **Cluster A - npm `@syncraft-labs/{core,react,vue}` EtherHiding blockchain-C2 dropper (2026-08-23)**: `@syncraft-labs/core@<=0.4.1` (GHSA-54xx-8x72-3539, hash `0efe2190…d4ac`), `@syncraft-labs/react@<=0.4.1` (GHSA-83j7-x5xf-qxwq, hash `c3986bd0…5cb9`), `@syncraft-labs/vue@<=0.4.1` (GHSA-9cqm-9mxm-f9gh, hash `d78f2856…065f`). All three share the same operator infrastructure. The **ESM build was tampered post-compile** (CJS build is clean, TypeScript source is clean — so the malware is invisible to a `git diff` of the source tree). The obfuscated payload hides inside a fake `isDevMode()` helper: on import it stashes `require`/`module`/`__filename` onto `globalThis`, then queries Ethereum JSON-RPC (`eth.drpc.org`, `ethereum-rpc.publicnode.com`, `eth-mainnet.public.blockscout.com`, `1rpc.io/eth`) for transactions from the attacker address `0xa322E5f3…`. Transaction call-data contains zlib-compressed JavaScript; the loader decompresses it and executes via `child_process.spawn`. Because the smart-contract data is **mutable and off-chain-blocklist**, blocking one C2 endpoint is useless — the operator posts a new transaction and every install worldwide gets a new payload with no republish. Same technique class as the [ChainDrop worm](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable) documented three weeks ago, but here run as a standalone dead-drop rather than as part of a self-propagating worm
- **Cluster B - npm `N-*-sight-web` mutable-Bitbucket dropper (2026-08-23, 5 packages)**: `2-loadsight-web@1.0.0-1.0.1` (GHSA-4f5v-fg99-x9xc, hash `cae23fe6…c08b5`), `3-buildsight-web@1.0.0-1.0.1` (GHSA-p6pp-6xxg-295v, hash `ed2d8b62…5545`), `6-viewsight-web@1.0.0-1.0.1` (GHSA-g8jq-29p5-5qrp, hash `96501ebb…6e68`), `8-fetchsight-web@1.0.0-1.0.1` (GHSA-6wj3-8mh4-prqm, hash `d0e6a4c6…f549`), `10-shardsight-web@1.0.0-1.0.1` (GHSA-6fq4-5r9g-9gfh, hash `4c7da642…4555`). Numeric-prefixed sibling family (`2-`, `3-`, `6-`, `8-`, `10-`) all identical in shape: on import a top-level async IIFE fetches HTML from `https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight` (**an unpinned `main` branch**), replaces `document.head`/`document.body` with the fetched markup, then re-creates every `<script>` element as a live script tag so the browser executes it in the host page origin. The Bitbucket workspace `p2p-alt-public` is not affiliated with any legitimate publisher, and every install downstream runs whatever the branch owner pushes right now — pure browser-side XSS by design
- **Cluster C - npm pino-impersonator `*-testing-utils`/`*-testkit` jsonstorage.net dropper (2026-08-23, 4 packages)**: `rust-testing-utils@2.3.0` (GHSA-mgfq-rgcw-ff87, hash `ee33bded…ffa65`), `solidity-testing-utils@1.2.0` (GHSA-g5g4-w6x5-58j4, hash `7a7ffd7d…f3bd8`), `hatdhat-testkit@<=3.2.14` (GHSA-3ghm-p4g2-9r6p, hash `83b6e58e…46d9`), `chai-as-testkit@<=2.3.5` (GHSA-4wfj-hpq9-58mw, hash `0bf8ab4a…cec31`). All four **impersonate the legitimate `pino` logging library** (copied README and source tree, fraudulent author `Robert King, hello@jsonspack.com`). First three share the same C2: `index.js` spawns `lib/caller.js` as a detached child process; caller.js base64-decodes an embedded URL to `https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f`, POSTs with an `x-secret-key` header, and executes the returned `cookie` field via `Function(...)`. `chai-as-testkit` is the same operator but ships a **4MB+ control-flow-flattened bundle** at `lib/config.js` that runs immediately on import — no lazy path. The `jsonstorage.net` collector is a public keyed JSON store, so blocking `api.jsonstorage.net` at the perimeter is the correlation lever
- **Cluster D - npm `stillm4ddpocs-*` oast.fun DNS-tunnel dep-confusion beacon (2026-08-22 → 2026-08-23, 5 packages)**: `stillm4ddpocs-demo-sprocket@999.9.12` (GHSA-6cpg-8367-hp87, hash `f71ba0f8…4e2b`), `stillm4ddpocs-rtest-alpha@999.9.9, 999.9.10` (GHSA-mrj6-mc6j-fpcm, hash `47545f80…3839`), `stillm4ddpocs-rtest-bravo@999.9.9, 999.9.10` (GHSA-j8vq-ph59-27pv, hash `15e4272b…f5f2`), `stillm4ddpocs-demo-widget@999.9.9` (GHSA-ghqx-mmmj-m486, hash `f71ba0f8…4e2b`), `stillm4ddpocs-demo-gadget@999.9.10, 999.9.12, 999.9.20` (GHSA-452p-xh57-7mqp, hash `3ade0d32…85c6`). All five use the **`999.9.x` dep-confusion sentinel version** so any resolver misconfigured to prefer the highest version across all registries picks the public tarball over the private internal one. `preinstall` collects hostname, username, home dir, local IPv4, egress IP (via `api.ipify.org`/`icanhazip.com`/`ifconfig.me`), DNS resolver config, and consuming-project `package.json`, then exfiltrates through **three** channels: HTTP POST/443, HTTPS POST/80, and DNS TXT lookups with hex-encoded chunks against `da51rv0hb2uc72tg4gvgdepinjcallbk1.oast.fun`. The DNS channel is deliberate: any org that egress-filters HTTP still leaks via recursive DNS. Package names ("still mad ppl", "PoC") plus README claims of "authorised security research" do **not** neutralise this — the beacon fires on every install, without consent, at any org the resolver happens to fall through to
- **Cluster E - npm `totp-utils` Minecraft JAR dropper + Discord/browser stealer (2026-08-23)**: `totp-utils@1.4.2-1.4.9` (GHSA-93j4-gp34-3h5m, hash `8cebaa0a…deeb5`). Masquerades as a TOTP helper. Two infection paths: (1) `postinstall` runs immediately, (2) the public API `validateSecret()` also runs the payload — so a consumer that ran with `--ignore-scripts` still triggers it on the first API call. Payload scans **Discord, Chrome, Edge, Brave, Opera** for auth tokens, extracts Minecraft launcher credentials (vanilla + Lunar + Modrinth stores), validates harvested Discord tokens against the real Discord API, and exfils to a Discord webhook (`discord.com/api/webhooks/1532429233769419004/…`). Separately, drops `optimized-renderer-1.0.0.jar` from `cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar` into the Minecraft mods directory — the JAR executes the next time the user launches Minecraft with Fabric loader, extending the compromise from install-time to a persistent lifestyle backdoor
- **Cluster F - npm `create-coin` esbuild `netbsd-x64` typosquat + trycloudflare env exfil (2026-08-23)**: `create-coin@<=20.1.1` (GHSA-468x-vgxv-xv9w, hash `d92da1d8…c380`). `package.json` falsely describes this as "netbsd-x64 build for esbuild" — a targeted typosquat of the esbuild platform-binary family. `postinstall` runs `build/payload.node.js` which: (1) checks for CI/GitHub Actions/Docker/limited-env fingerprints and skips if sandboxed (**anti-analysis**), (2) reads `~/.npmrc`, `package.json`, `package-lock.json`, `.env`, and `src/config.*`, (3) enumerates hostname, user, and open localhost ports, (4) POSTs the full `process.env` to `https://<random-name>.trycloudflare.com` with cert-validation disabled, (5) drops a `.ran` idempotency marker to avoid re-firing, (6) forces exit code 0 to mask any errors, (7) sleeps 10-30s randomly to defeat naïve timing correlation. Any developer who ran `npm install create-coin` has leaked their entire shell environment plus all `.env`/`.npmrc` secrets
- **Cluster G - npm `@usaa-grp-personal-profile/personal-profile-common` USAA-targeted dep-confusion with DNS exfil (2026-08-23)**: `@usaa-grp-personal-profile/personal-profile-common@999.0.0` (GHSA-rh37-fc24-hw7w, hash `de7570e7…630a`). Highly targeted: scope `@usaa-grp-personal-profile` reads as USAA (the US bank/insurer) internal group. `999.0.0` is the dep-confusion sentinel. `beacon.js` collects hostname/username/CWD, hex-encodes it into DNS labels, and exfils via DNS TXT queries to attacker-controlled `oastify.com` subdomains (Burp Collaborator public OAST). If USAA has a private `@usaa-grp-personal-profile` scope, the operator now has a confirmed catchment for a targeted follow-up
- **Cluster H - npm `internallib_v902` no-IOC dep-confusion pull (2026-08-22)**: `internallib_v902@>=0` (GHSA-3p65-4jqj-5j69). GHSA published no per-package IOCs — the boilerplate `"any computer with this package installed should be considered fully compromised"`. The `internallib_` prefix + numeric suffix pattern (`_v902`) matches the fingerprint of the internal-lib-guessing dep-confusion campaign already tracked at [/incident/multi-2026-08-19-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-19-ghsa-malware-sweep) and prior sweeps; treat as full RCE against any org running a private `internallib_*` scope
- **Cluster I - PyPI `scrambleeeer` (four e's) fifth `2026-08-scrambleeer/reqcrypt` sibling variant (2026-08-22)**: `scrambleeeer@0.1.0` (GHSA-xw2j-24j3-3282, hash `52bcde49…d414`, campaign `2026-08-scrambleeer`). Hardcoded reverse shell — same payload shape as `scrambleeer` (three e's, [2026-08-22 sweep](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep) Cluster C). This is the **fifth republish across the combined `reqcrypt`/`scrambleeer` operator space** (`reqcrypt`, `reqcrypt-dev`, `reqcrypts`, `requests-crypt`, `scrambleeer`, `scrambleeeer`), confirming the operator is running a **letter-shuffle takedown-evasion register**: any host that ran `pip install scrambleeeer` gave the operator an interactive shell
- **Cluster J - PyPI `libasync` cryptominer + registry-key persistence (2026-08-20)**: `libasync@1.0.0` (GHSA-7vpc-7xx6-5v47, hashes `a46929f4…eb9c`, `11d7c6bd…a278`, `b7e770b7…c0d0`, campaign `2026-08-libasync`, tracked upstream as related to `2026-07-pyqt6darktheme`). Installs a **native (C-extension) bootstrapper** that downloads a remote executable, establishes persistence via Windows registry keys, and runs a cryptominer. Ships obfuscated code + sandbox-detection so dynamic analysis has to fight the sample. Any Windows host that ran `pip install libasync` needs to be re-imaged and its wallet + browser + VPN credentials rotated

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for: `@syncraft-labs/core`, `@syncraft-labs/react`, `@syncraft-labs/vue`, `2-loadsight-web`, `3-buildsight-web`, `6-viewsight-web`, `8-fetchsight-web`, `10-shardsight-web`, `rust-testing-utils`, `solidity-testing-utils`, `hatdhat-testkit`, `chai-as-testkit`, `stillm4ddpocs-demo-sprocket`, `stillm4ddpocs-rtest-alpha`, `stillm4ddpocs-rtest-bravo`, `stillm4ddpocs-demo-widget`, `stillm4ddpocs-demo-gadget`, `totp-utils`, `create-coin`, `@usaa-grp-personal-profile/personal-profile-common`, `internallib_v902`, `scrambleeeer`, `libasync`
2. **For Cluster A (`@syncraft-labs/*` EtherHiding)**: uninstall and treat any host that resolved a build as compromised. `--ignore-scripts` does NOT help — the payload runs on `import`/`require` from the ESM bundle, so every downstream app that shipped it to a browser or Node runtime already fetched a blockchain payload. Rotate credentials the process could reach: npm auth tokens, cloud tokens, SSH keys, git tokens, `.env` values. **Do not rely on blocking the RPC endpoints** — the operator can add more (any public Ethereum RPC works). The correlation lever is unexpected outbound HTTP to any Ethereum JSON-RPC (`*.drpc.org`, `*.publicnode.com`, `blockscout.com`, `1rpc.io`, `etherscan.io`) from a build runner. Same class of technique as [ChainDrop](https://dependencywatch.io/incident/npm-2026-08-04-shai-hulud-keyv-cacheable) — if you already have EtherHiding-aware detections for ChainDrop, this sample should light them up
3. **For Cluster B (`N-*-sight-web`)**: uninstall from every frontend bundle. Any HTML that shipped these packages ran arbitrary Bitbucket-hosted JavaScript **in the host page origin** — treat as a live XSS window on every user of the affected app for the entire time the package was deployed. Add `bitbucket.org/p2p-alt-public/*` to your outbound-block list for browsers and CI. Consider a Content-Security-Policy tightening pass so runtime script injection cannot happen against a page origin without an explicit allow-list
4. **For Cluster C (`*-testing-utils`/`*-testkit`)**: uninstall from every project and CI pipeline. Because the payload is fetched at runtime from a mutable JSON store (`api.jsonstorage.net`), any host that ran `require("chai-as-testkit")` or the middleware from any of the four packages already loaded operator-controlled JavaScript with full `require()` access. Rotate credentials. Add `api.jsonstorage.net` to egress deny for build runners and dev hosts (no legitimate CI/build use). Watch for republishes under adjacent slugs (`vitest-testing-utils`, `mocha-testkit`, `jest-testkit`) — the impersonator template is trivially reusable
5. **For Cluster D (`stillm4ddpocs-*`)**: uninstall from every private-registry cache. **Lock private-registry resolution to explicit-scope-only** so a `999.9.x` public tarball cannot beat your internal semver. Because Cluster D exfils via DNS to `*.oast.fun`, HTTP-only egress blocks do **not** cover it — add `oast.fun`, `oastify.com`, `webhook.site`, and `interact.sh` to your DNS RPZ / resolver deny list. Treat any host that installed one as leaked (hostname, egress IP, project name, resolver config are now known to the operator)
6. **For Cluster E (`totp-utils`)**: uninstall from every project. Because the payload fires both on `postinstall` **and** on the first `validateSecret()` call, `--ignore-scripts` alone is insufficient — any developer or CI job that called the advertised API also triggered the stealer. Assume Discord, Chrome, Edge, Brave, and Opera token stores are exfiltrated; log out of Discord everywhere, rotate Discord passwords + 2FA, force-clear browser saved passwords + auth cookies. If the host runs Minecraft with Fabric, remove `optimized-renderer-1.0.0.jar` from the mods directory and rebuild the modpack from a known-good source. Add `discord.com/api/webhooks/*` and `cdn.discordapp.com/attachments/*` to egress deny for build runners and non-Discord-user machines
7. **For Cluster F (`create-coin`)**: uninstall. Because postinstall exfils full `process.env` to a `trycloudflare.com` tunnel, rotate every credential in the shell that ran `npm install`: npm auth tokens (`~/.npmrc`), CI/CD secrets, cloud tokens, database URLs, API keys, plus every `.env` value sourced into the shell. Add `*.trycloudflare.com` to egress deny for build runners — Cloudflare Tunnel has no legitimate build-time use, and it is a common short-lived-tunnel C2 pattern (also seen in [`clx` DGA dropper](https://dependencywatch.io/incident/npm-2026-07-01-clx-cookie-dga-dropper))
8. **For Cluster G (`@usaa-grp-*`)**: if you operate anywhere near USAA infrastructure or use a `@usaa-grp-*` scope, lock your private-registry proxy to explicit-scope-only resolution and audit whether the private scope was ever queried from outside the corporate egress. Treat as an active dependency-confusion probe against a specific target
9. **For Cluster H (`internallib_v902`)**: block at your registry proxy. Because the naming pattern matches the earlier `internallib_*` guessing campaign, review your private-registry logs for other `internallib_v<NNN>` resolutions in the last 90 days
10. **For Cluster I (`scrambleeeer` 4-e)**: uninstall from every virtualenv. Correlate scanner state across the six-variant register (`reqcrypt`, `reqcrypt-dev`, `reqcrypts`, `requests-crypt`, `scrambleeer`, `scrambleeeer`) — a scanner that tracked five will miss the sixth. Expect a seventh variant (`scrambleeeeer`, `screambler`, `reqcrypto`) within days
11. **For Cluster J (`libasync`)**: uninstall from every virtualenv. Any Windows host that installed it: re-image, then rotate wallet, browser, VPN, and SSH credentials before restoring. Grep `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM\...\Run` for entries added on or after 2026-08-20 that reference an executable in `%APPDATA%` / `%LOCALAPPDATA%` / `%TEMP%`
12. For all npm installs in CI, run with `--ignore-scripts` — this blocks Cluster D preinstall beacons and Cluster F postinstall env exfil, but does **not** block Clusters A/B/C/E (all fire on import or first API call, not on script hooks). For all `pip install` runs, prefer `--only-binary=:all:` and pin transitive dependencies from a curated allow-list
13. Verify none of these packages still resolves via your private mirror — internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-54xx-8x72-3539 - @syncraft-labs/core (npm EtherHiding blockchain-C2 dropper)](https://github.com/advisories/GHSA-54xx-8x72-3539) - GitHub
- [GHSA-83j7-x5xf-qxwq - @syncraft-labs/react (npm EtherHiding blockchain-C2 dropper)](https://github.com/advisories/GHSA-83j7-x5xf-qxwq) - GitHub
- [GHSA-9cqm-9mxm-f9gh - @syncraft-labs/vue (npm EtherHiding blockchain-C2 dropper)](https://github.com/advisories/GHSA-9cqm-9mxm-f9gh) - GitHub
- [GHSA-4f5v-fg99-x9xc - 2-loadsight-web (npm Bitbucket dynamic-script dropper)](https://github.com/advisories/GHSA-4f5v-fg99-x9xc) - GitHub
- [GHSA-p6pp-6xxg-295v - 3-buildsight-web (npm Bitbucket dynamic-script dropper)](https://github.com/advisories/GHSA-p6pp-6xxg-295v) - GitHub
- [GHSA-g8jq-29p5-5qrp - 6-viewsight-web (npm Bitbucket dynamic-script dropper)](https://github.com/advisories/GHSA-g8jq-29p5-5qrp) - GitHub
- [GHSA-6wj3-8mh4-prqm - 8-fetchsight-web (npm Bitbucket dynamic-script dropper)](https://github.com/advisories/GHSA-6wj3-8mh4-prqm) - GitHub
- [GHSA-6fq4-5r9g-9gfh - 10-shardsight-web (npm Bitbucket dynamic-script dropper)](https://github.com/advisories/GHSA-6fq4-5r9g-9gfh) - GitHub
- [GHSA-mgfq-rgcw-ff87 - rust-testing-utils (npm pino-impersonator jsonstorage.net dropper)](https://github.com/advisories/GHSA-mgfq-rgcw-ff87) - GitHub
- [GHSA-g5g4-w6x5-58j4 - solidity-testing-utils (npm pino-impersonator jsonstorage.net dropper)](https://github.com/advisories/GHSA-g5g4-w6x5-58j4) - GitHub
- [GHSA-3ghm-p4g2-9r6p - hatdhat-testkit (npm pino-impersonator jsonstorage.net dropper)](https://github.com/advisories/GHSA-3ghm-p4g2-9r6p) - GitHub
- [GHSA-4wfj-hpq9-58mw - chai-as-testkit (npm pino-impersonator CFF bundle)](https://github.com/advisories/GHSA-4wfj-hpq9-58mw) - GitHub
- [GHSA-6cpg-8367-hp87 - stillm4ddpocs-demo-sprocket (npm oast.fun DNS dep-confusion)](https://github.com/advisories/GHSA-6cpg-8367-hp87) - GitHub
- [GHSA-mrj6-mc6j-fpcm - stillm4ddpocs-rtest-alpha (npm oast.fun DNS dep-confusion)](https://github.com/advisories/GHSA-mrj6-mc6j-fpcm) - GitHub
- [GHSA-j8vq-ph59-27pv - stillm4ddpocs-rtest-bravo (npm oast.fun DNS dep-confusion)](https://github.com/advisories/GHSA-j8vq-ph59-27pv) - GitHub
- [GHSA-ghqx-mmmj-m486 - stillm4ddpocs-demo-widget (npm oast.fun DNS dep-confusion)](https://github.com/advisories/GHSA-ghqx-mmmj-m486) - GitHub
- [GHSA-452p-xh57-7mqp - stillm4ddpocs-demo-gadget (npm oast.fun DNS dep-confusion)](https://github.com/advisories/GHSA-452p-xh57-7mqp) - GitHub
- [GHSA-93j4-gp34-3h5m - totp-utils (npm Discord/browser stealer + Minecraft JAR)](https://github.com/advisories/GHSA-93j4-gp34-3h5m) - GitHub
- [GHSA-m72r-95xc-q6g8 - totp-utils (secondary GHSA cross-listing published 2026-08-23; same package, boilerplate CWE-506 entry, no additional IOCs)](https://github.com/advisories/GHSA-m72r-95xc-q6g8) - GitHub
- [GHSA-468x-vgxv-xv9w - create-coin (npm esbuild typosquat + trycloudflare env exfil)](https://github.com/advisories/GHSA-468x-vgxv-xv9w) - GitHub
- [GHSA-rh37-fc24-hw7w - @usaa-grp-personal-profile/personal-profile-common (npm USAA-targeted dep-confusion)](https://github.com/advisories/GHSA-rh37-fc24-hw7w) - GitHub
- [GHSA-3p65-4jqj-5j69 - internallib_v902 (npm no-IOC dep-confusion pull)](https://github.com/advisories/GHSA-3p65-4jqj-5j69) - GitHub
- [GHSA-xw2j-24j3-3282 - scrambleeeer (PyPI 2026-08-scrambleeer/reqcrypt sixth variant)](https://github.com/advisories/GHSA-xw2j-24j3-3282) - GitHub
- [GHSA-7vpc-7xx6-5v47 - libasync (PyPI cryptominer + registry-key persistence)](https://github.com/advisories/GHSA-7vpc-7xx6-5v47) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [ChainDrop npm Worm: EtherHiding blockchain-C2 (StepSecurity, background on the EtherHiding technique used by Cluster A)](https://www.stepsecurity.io/blog/chaindrop-npm-worm) - StepSecurity

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).