GitHub Advisory malware sweep, 24 August 2026

The full picture

12 packages 18 versions

• npm@opap/player-kyc-widget3.999.999→
• npm@sdgdfgdfhhhfd/chainvista→
• npm@sdgdfgdfhhhfd/multiviewr→
• npmconversa-sdk1.0.01.0.41.0.51.0.61.0.81.0.92.0.02.0.22.0.32.0.4→
• PyPIcryptgraphy1.0.0→
• PyPIenvprovision1.2.01.3.01.4.0→
• npmfund-list-filter999.9.12→
• npmfund-portfolio999.9.12→
• npmhydration-dim-kit→
• npmidentitysecuretokenserv→
• PyPImlflow-otel-instrumentor1.1.0→
• npmsvelte-dim-kit→

What it does if you installed it

• Cluster A - PyPI envprovision Snow Stealer Windows infostealer (2026-08-24, 3 versions): envprovision@1.2.0, 1.3.0, 1.4.0 (GHSA-xr9j-7gjp-x8fg, source hash cf3a48b4…d869, VT file hash d49fa539…b878, campaign Snow Stealer). Windows-specific dropper. Malicious functionality hidden inside exported library functions so a defender scanning for a top-level os.system() misses it. On import (Windows only): downloads and installs a remote executable, disguises it as a system utility so a casual msconfig / Task Manager review misses it, then cleans logs and removes the downloaded stager to defeat forensic recovery. Payload identified as Snow Stealer - a Windows infostealer that (a) enumerates browser data (Chrome, Edge, Brave, Firefox saved logins, cookies, autofill), (b) modifies cryptowallet application binaries so subsequent transaction-signing flows leak keys, (c) implements multiple sandbox-evasion checks (process list, mouse-movement heuristics, VM-tell registry keys) so dynamic analysis has to actively fight the sample. Any Windows host that ran pip install envprovision needs re-imaging plus wallet-key rotation before restoring
• Cluster B - PyPI cryptgraphy+mlflow-otel-instrumentor cryptominer worm - 2026-08-boto4 operator continuation (2026-08-23, 2 packages): cryptgraphy@>=1.0.0 (GHSA-2v43-g59q-gxp6, source hash d303a7fa…3a1a, VT file hash 051f8704…12e9), mlflow-otel-instrumentor@>=1.1.0 (GHSA-w427-8xgw-fvcw, source hash 596b37ce…0bbf, VT file hash 051f8704…12e9 identical to cryptgraphy, campaign 2026-08-mlflow-otel-instrumentor, explicit similarity to 2026-08-boto4). Both packages ship the same downloaded executable (identical VT file hash) so a scanner that flagged boto4 earlier this week should already be tuned for this file. Payload targets: (1) persistence via systemd services (Linux-native, not Windows Run keys - so this is targeting build/deploy Linux hosts, not developer laptops), (2) XMR-shape cryptomining, (3) worm-style propagation over the local network (see boto4 2026-08-22 for the shared worm shape). Two typosquat targets: cryptography (the widely-used pyca crypto library) and mlflow + opentelemetry (a plausible extension to the mlflow tracing story). The naming discipline (real ecosystem name + real adjacent tech) points to an operator with dictionary preparation, not opportunistic spray
• *Cluster C - npm `fund- 999.9.12 dep-confusion beacon pair (2026-08-23, 2 packages)**: fund-list-filter@999.9.12 (GHSA-ww7v-m7hw-7m2q, hash d7cde5bd…8281), fund-portfolio@999.9.12 (GHSA-8qph-p7jr-c2xf, hash ffad2f6c…03bf). Both share the **999.9.12 dep-confusion sentinel version** and the boilerplate "The package communicates with a domain associated with malicious activity" indicator. Fund-industry naming (fund-list, fund-portfolio`) points to a targeted probe against a specific asset-management or fintech internal registry - any resolver misconfigured to prefer highest-version-across-registries picks the public tarball over a lower-versioned internal one. GHSA does not publish the specific callback domain per package, but the shared version pattern + shared advisory shape confirms a single operator running a two-package catchment probe
• Cluster D - npm @opap/player-kyc-widget OPAP (Greek gambling operator) targeted KYC dep-confusion (2026-08-23, 1 package): @opap/player-kyc-widget@<=3.999.999 (GHSA-w2m6-3q96-chrf, hash 98e627ce…6885). Highly targeted: the @opap scope reads as OPAP (Organisation of Football Prognostics S.A., Greece's dominant regulated gambling operator - sports betting, lottery, casino). player-kyc-widget implies a Know-Your-Customer identity-verification UI component - the exact flow that receives customer ID documents, selfies, and bank-account references during onboarding. The <=3.999.999 version pattern is the classic dep-confusion sentinel: any OPAP resolver misconfigured to prefer highest-version-across-registries picks the public tarball over any lower-versioned internal @opap/player-kyc-widget. Advisory notes "the package communicates with a domain associated with malicious activity" but does not publish the specific callback. Any successful catchment gives the operator a live foothold inside the KYC pipeline of a regulated gambling operator - the payoff on a follow-up payload would be direct access to unredacted customer PII and possibly session cookies for the KYC verifier
• *Cluster E - npm `-dim-kit framework-adjacent typosquat pair (2026-08-23, 2 packages)**: hydration-dim-kit@>=0 (GHSA-p33f-w7x3-mxrr, no per-package IOCs), svelte-dim-kit@>=0 (GHSA-64x3-8jmm-fhp8, no per-package IOCs). Both are boilerplate CWE-506 pulls where GHSA published only the standard "considered fully compromised" text. Naming reads as **framework hydration helpers**: hydration-dim-kit (React/Next.js SSR hydration), svelte-dim-kit (Svelte SSR). The shared -dim-kit` suffix + same publication day strongly suggests a single operator running a two-shot typosquat register against SSR-adjacent dev tooling. Treat as full RCE against any host that installed either
• *Cluster F - npm `@sdgdfgdfhhhfd/ mash-scope disposable-operator pair (2026-08-23, 2 packages)**: @sdgdfgdfhhhfd/multiviewr@>=0 (GHSA-wwgv-4qvc-7339, no per-package IOCs), @sdgdfgdfhhhfd/chainvista@>=0 (GHSA-849m-c6hc-74xx, no per-package IOCs). The scope @sdgdfgdfhhhfd is a **keyboard-mash disposable throwaway** - no legitimate publisher owns that scope, and the pattern (multiviewr = crypto multi-viewer, chainvista` = blockchain viewer) targets crypto-wallet users searching for portfolio-tracking UIs. Boilerplate CWE-506 pulls, no per-package IOCs published. Same operator across both slugs. Any host that installed either should treat wallet keys as leaked
• Cluster G - npm conversa-sdk 10-version maintainer-takeover or long-form typosquat (2026-08-24, 1 package): conversa-sdk@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4 (GHSA-8m82-6fp4-38m4, no per-package IOCs). Ten affected versions spanning both a 1.x and a 2.x release train is the fingerprint of either (a) an established package whose maintainer was compromised and all releases republished with malware, or (b) a long-running typosquat of a real "conversa" chatbot/CX SDK where the operator kept version-bumping to catch scanners tracking a specific version. GHSA published no per-package IOCs. Treat every host that installed any listed version as fully compromised, and check publish dates on the affected versions against your first-install date to scope exposure
• Cluster H - npm identitysecuretokenserv internal-name dep-confusion pull (2026-08-24, 1 package): identitysecuretokenserv@>=0 (GHSA-2g7g-rqj2-26hv, no per-package IOCs). The slug (identity + secure + token + serv = "identity secure token server") matches the fingerprint of an internal-microservice-name dep-confusion probe - the operator guessed a plausible internal package name that some organisation might publish to a private scope, and squatted it public so a misconfigured resolver picks the public one. Boilerplate CWE-506 pull, no IOCs. Treat as full RCE against any private-registry proxy that ever fell through to public with a matching internal name

Clean-up steps

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: envprovision, cryptgraphy, mlflow-otel-instrumentor, fund-list-filter, fund-portfolio, @opap/player-kyc-widget, hydration-dim-kit, svelte-dim-kit, @sdgdfgdfhhhfd/multiviewr, @sdgdfgdfhhhfd/chainvista, conversa-sdk, identitysecuretokenserv
2. 2For Cluster A (envprovision Snow Stealer): any Windows host that ran pip install envprovision needs to be re-imaged - the dropper cleans its own logs, so post-hoc forensic recovery is unreliable. Before rebuilding, rotate every credential in every browser saved-password store, every cryptocurrency wallet seed, every VPN cred, every SSH key on the host. If the host holds hot wallets, assume funds are drained - transfer any remaining balance to a fresh wallet generated on a known-clean machine. Add the VT file hash d49fa539…b878 to endpoint AV / EDR blocklists. The Snow Stealer family also modifies wallet application binaries so any wallet software installed after the compromise cannot be trusted - reinstall from vendor sources
3. 3For Cluster B (cryptgraphy + mlflow-otel-instrumentor): uninstall from every virtualenv and CI pipeline. Because the payload propagates worm-style across the local network (shared shape with boto4 2026-08-22), isolate the L2 segment before rebuilding: check every other host on the same subnet for the same VT file hash 051f8704…12e9. Persistence lives in systemd unit files on Linux - systemctl list-unit-files --state=enabled | grep -v '/lib/systemd' for enabled units in unexpected paths (/tmp, /var/tmp, ~/.config/systemd/user, /etc/systemd/system/*.service added in the last 7 days); disable and delete any that reference an executable in a user or tmp directory. If Nvidia GPUs are attached to the host, check GPU utilisation and process list - the cryptominer will show sustained non-zero GPU load without a matching workload
4. 4For Cluster C (fund-list-filter + fund-portfolio): if you operate a private npm registry with a fund-* scope, lock your private-registry proxy to explicit-scope-only resolution so a 999.9.12 public tarball cannot beat your internal semver. Audit the private-registry logs for other fund-* resolutions in the last 90 days. The 999.9.x sentinel-version pattern also matches the stillm4ddpocs-* cluster from 2026-08-23 and the lumen-pages-community@9.9.9 beacon from 2026-08-22 - if your registry has been surveyed by multiple 999.x.x probes, treat it as an active dep-confusion catchment and audit your recent installs
5. 5For Cluster D (@opap/player-kyc-widget): if you operate near OPAP infrastructure or use any @opap/* scope in a private registry, lock private-registry resolution to explicit-scope-only immediately - the version pattern <=3.999.999 is designed to beat any legitimate 3.x/4.x internal version. Audit private-registry logs for any @opap/* resolutions in the last 90 days from outside the corporate egress; treat any match as evidence of a successful dep-confusion catch. Because the target is a KYC pipeline, factor regulatory disclosure obligations (Greek DPA / GDPR / EU gambling regulator) into the incident response if a customer-data path is affected
6. 6*For Cluster E (`-dim-kit`)**: uninstall from every project. Because GHSA published no runtime IOCs, monitor egress from any host that installed either package for outbound connections to previously-unseen domains for at least 30 days
7. 7*For Cluster F (`@sdgdfgdfhhhfd/`)**: uninstall. Watch for republishes under adjacent throwaway scopes - a mash-scope operator that publishes two packages under one scope is trivially rebuildable under another mash-scope for the next batch
8. 8For Cluster G (conversa-sdk): uninstall every listed version. Because ten versions across two release trains are affected, check your install timeline: any version pulled between the first affected release and today should be treated as compromised. Rotate credentials the install shell could reach; if the package was consumed at runtime by a customer-facing service, rebuild from the last known-clean version (which may be prior to the entire affected range if this is a maintainer takeover)
9. 9For Cluster H (identitysecuretokenserv): block at your registry proxy. Because the name matches an internal-microservice fingerprint, audit any private-registry identity* or *-token-serv* resolutions from outside the corporate egress in the last 90 days
10. 10For all npm installs in CI, run with --ignore-scripts where possible - though for Clusters C/D/G, the payload may fire on require()/import rather than lifecycle hooks, so --ignore-scripts alone is insufficient. For all pip install runs, prefer --only-binary=:all: (Clusters A and B both ship native/executable stagers so binary-only is not automatically safe) and pin transitive dependencies from a curated allow-list
11. 11Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

Sources

• GHSA-xr9j-7gjp-x8fg - envprovision (PyPI Snow Stealer Windows infostealer)github.comGitHub
• GHSA-2v43-g59q-gxp6 - cryptgraphy (PyPI cryptominer + worm, 2026-08-boto4 operator continuation)github.comGitHub
• GHSA-w427-8xgw-fvcw - mlflow-otel-instrumentor (PyPI cryptominer + worm, identical payload to cryptgraphy)github.comGitHub
• GHSA-ww7v-m7hw-7m2q - fund-list-filter (npm 999.9.12 dep-confusion beacon)github.comGitHub
• GHSA-8qph-p7jr-c2xf - fund-portfolio (npm 999.9.12 dep-confusion beacon)github.comGitHub
• GHSA-w2m6-3q96-chrf - @opap/player-kyc-widget (npm OPAP-targeted KYC dep-confusion)github.comGitHub
• GHSA-p33f-w7x3-mxrr - hydration-dim-kit (npm framework typosquat)github.comGitHub
• GHSA-64x3-8jmm-fhp8 - svelte-dim-kit (npm framework typosquat)github.comGitHub
• GHSA-wwgv-4qvc-7339 - @sdgdfgdfhhhfd/multiviewr (npm mash-scope crypto viewer)github.comGitHub
• GHSA-849m-c6hc-74xx - @sdgdfgdfhhhfd/chainvista (npm mash-scope crypto viewer)github.comGitHub
• GHSA-8m82-6fp4-38m4 - conversa-sdk (npm 10-version compromised release)github.comGitHub
• GHSA-2g7g-rqj2-26hv - identitysecuretokenserv (npm internal-name dep-confusion pull)github.comGitHub
• GitHub Advisory Database - recent npm malware advisoriesgithub.comGitHub
• GitHub Advisory Database - recent pip malware advisoriesgithub.comGitHub
• Related: 2026-08-22 sweep (boto4 Telegram-C2 miner + worm, same operator as Cluster B)github.comGitHub