GitHub Advisory malware sweep - 2026-08-24 batch (PyPI `envprovision` Snow Stealer + PyPI `cryptgraphy`/`mlflow-otel-instrumentor` cryptominer worm continuation of `2026-08-boto4` + npm `fund-list-filter`/`fund-portfolio` 999.9.12 dep-confusion + npm `@opap/player-kyc-widget` OPAP gambling KYC probe + npm `hydration-dim-kit`/`svelte-dim-kit` framework typosquat + npm `@sdgdfgdfhhhfd/*` mash-scope dropper + npm `conversa-sdk` 10-version hijack + npm `identitysecuretokenserv` internal-name dep-confusion)

What happened

The 24-hour window ending 2026-08-24 06:00 UTC published 6 new GHSA CWE-506 advisories on npm and 3 on PyPI, plus catch-up entries for 4 npm advisories dated 2026-08-23 that landed after the previous sweep window closed. Two things about this batch matter beyond the usual sweep noise: (1) envprovision ships a named Windows infostealer (Snow Stealer) that modifies cryptowallet binaries and self-cleans logs; (2) the cryptgraphy+mlflow-otel-instrumentor pair carries the identical VT file hash as - and is explicitly labelled a continuation of - the boto4 cryptominer worm from 48h earlier, confirming that operator is running fresh brand rotations to survive takedowns.

Cluster A - PyPI envprovision Snow Stealer Windows infostealer (1 package, 3 versions)

| Package | Versions | GHSA | Source hash | VT file hash | Payload | |---|---|---|---|---|---| | envprovision | 1.2.0, 1.3.0, 1.4.0 | GHSA-xr9j-7gjp-x8fg | cf3a48b4…d869 | d49fa539…b878 | Snow Stealer |

Windows-only dropper hidden inside exported library functions (not a top-level os.system(), so a shallow static scan misses it). On import the package downloads a remote executable, saves it under a system-utility-looking filename, then cleans logs and deletes the downloaded stager to defeat forensic recovery. The dropped payload is identified as Snow Stealer - a Windows infostealer with three defining behaviours: enumeration of browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox); modification of cryptocurrency wallet application binaries so subsequent transaction-signing flows can be tampered post-compromise; and sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) that make dynamic analysis fight the sample. Any Windows host that installed the package needs re-imaging plus wallet-key rotation - browser store rotation is not sufficient because the wallet binary itself has been tampered.

Cluster B - PyPI cryptgraphy + mlflow-otel-instrumentor cryptominer worm - 2026-08-boto4 operator continuation (2 packages)

| Package | Versions | GHSA | Source hash | VT file hash | Campaign | |---|---|---|---|---|---| | cryptgraphy | >=1.0.0 | GHSA-2v43-g59q-gxp6 | d303a7fa…3a1a | 051f8704…12e9 | 2026-08-mlflow-otel-instrumentor (linked to 2026-08-boto4) | | mlflow-otel-instrumentor | >=1.1.0 | GHSA-w427-8xgw-fvcw | 596b37ce…0bbf | 051f8704…12e9 | 2026-08-mlflow-otel-instrumentor (linked to 2026-08-boto4) |

Both packages ship the same executable (identical VT file hash 051f8704…12e9). The advisories explicitly note the campaign shares similarities with the 2026-08-boto4 cryptominer worm from 48h earlier. Payload behaviours:

• persistence via systemd services (Linux-native - the operator is targeting build servers and Linux dev hosts, not developer Windows laptops)
• cryptomining (XMR-shape based on the shared operator lineage)
• worm-style propagation over the local network (see boto4 writeup for the shared shape - it enumerates the local subnet and attempts to spread laterally)

The two typosquat targets are notable for dictionary discipline: cryptography is the pyca crypto library (a foundational transitive dependency for anything doing TLS in Python), and mlflow + opentelemetry maps to a plausible-sounding integration package that an ML engineer might install without a second look. This is the third distinct brand this operator has shipped in seven days (libasync 2026-08-20 → boto4 2026-08-22 → cryptgraphy/mlflow-otel-instrumentor 2026-08-23). Expect a fresh brand within days.

Cluster C - npm fund-* 999.9.12 dep-confusion beacon pair (2 packages)

| Package | Versions | GHSA | Hash | Notes | |---|---|---|---|---| | fund-list-filter | 999.9.12 | GHSA-ww7v-m7hw-7m2q | d7cde5bd…8281 | "communicates with a domain" | | fund-portfolio | 999.9.12 | GHSA-8qph-p7jr-c2xf | ffad2f6c…03bf | "communicates with a domain" |

Shared 999.9.12 dep-confusion sentinel version. Fund-industry naming (fund-list-filter, fund-portfolio) suggests a targeted probe against a specific asset-management or fintech internal registry. GHSA does not publish the callback domain per package, but the shared version + shared advisory shape confirms a single operator running a two-package catchment. The 999.9.x sentinel pattern also appears in the stillm4ddpocs-* cluster from 2026-08-23 and the lumen-pages-community@9.9.9 beacon from 2026-08-22 - dep-confusion probing is running at a steady 1-3 packages per day across multiple operators.

Cluster D - npm @opap/player-kyc-widget OPAP-targeted KYC dep-confusion (1 package)

| Package | Versions | GHSA | Hash | Target | |---|---|---|---|---| | @opap/player-kyc-widget | <=3.999.999 | GHSA-w2m6-3q96-chrf | 98e627ce…6885 | OPAP (Greek regulated gambling operator) KYC pipeline |

Highly targeted. @opap reads as OPAP (Organisation of Football Prognostics S.A., Greece's dominant regulated gambling operator - sports betting, lottery, casino). player-kyc-widget implies a Know-Your-Customer identity-verification UI component - the exact flow that receives customer identity documents, selfies, and bank-account details during onboarding. The <=3.999.999 version pattern is the classic dep-confusion sentinel: any OPAP resolver misconfigured to prefer highest-version-across-registries picks the public tarball over any lower-versioned internal @opap/player-kyc-widget.

Advisory notes the package "communicates with a domain associated with malicious activity" but does not publish the specific callback. Any successful catchment gives the operator a live foothold inside the KYC pipeline of a regulated gambling operator - unredacted customer PII, ID document images, and session cookies for the KYC verifier are all in reach. If this catches, the regulatory disclosure obligations (Greek DPA / GDPR / EU gambling regulator) start counting from the catchment date, not the discovery date.

Cluster E - npm *-dim-kit framework-adjacent typosquat pair (2 packages)

| Package | Versions | GHSA | Note | |---|---|---|---| | hydration-dim-kit | >=0 | GHSA-p33f-w7x3-mxrr | Boilerplate CWE-506, no per-package IOCs | | svelte-dim-kit | >=0 | GHSA-64x3-8jmm-fhp8 | Boilerplate CWE-506, no per-package IOCs |

Same -dim-kit suffix, same publication day, same boilerplate advisory shape - single operator running a two-shot typosquat register against SSR/hydration-adjacent dev tooling. Names read as React/Next.js and Svelte hydration helpers. No runtime IOCs published; treat as full RCE against any host that installed either.

Cluster F - npm @sdgdfgdfhhhfd/* mash-scope crypto-viewer pair (2 packages)

| Package | Versions | GHSA | Note | |---|---|---|---| | @sdgdfgdfhhhfd/multiviewr | >=0 | GHSA-wwgv-4qvc-7339 | Boilerplate CWE-506, no per-package IOCs | | @sdgdfgdfhhhfd/chainvista | >=0 | GHSA-849m-c6hc-74xx | Boilerplate CWE-506, no per-package IOCs |

The scope @sdgdfgdfhhhfd is a keyboard-mash disposable throwaway - no legitimate publisher owns that scope. Package names (multiviewr = crypto multi-viewer, chainvista = blockchain viewer) target crypto-wallet users searching for portfolio-tracking UIs. Same operator across both slugs. Any host that installed either should treat wallet keys as leaked. This mash-scope publishing pattern is a common takedown-evasion trick: after the two slugs are yanked, the operator drops a fresh mash-scope tomorrow with two more slugs, and a scanner keyed to @sdgdfgdfhhhfd misses it.

Cluster G - npm conversa-sdk 10-version release (1 package)

| Package | Versions | GHSA | Note | |---|---|---|---| | conversa-sdk | 1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4 | GHSA-8m82-6fp4-38m4 | Boilerplate CWE-506, no per-package IOCs |

Ten affected versions across a 1.x and 2.x release train is diagnostic: either (a) an established package whose maintainer account was compromised and all releases were republished with malware inserted, or (b) a long-running typosquat of a real "conversa" chatbot/CX SDK where the operator kept version-bumping to catch scanners tracking a specific version. GHSA published no runtime IOCs. Any host that installed any listed version should be treated as fully compromised; scope by comparing install date against the affected-version publish dates.

Cluster H - npm identitysecuretokenserv internal-name dep-confusion pull (1 package)

| Package | Versions | GHSA | Note | |---|---|---|---| | identitysecuretokenserv | >=0 | GHSA-2g7g-rqj2-26hv | Boilerplate CWE-506, no per-package IOCs |

The slug identity + secure + token + serv matches the fingerprint of an internal-microservice-name dep-confusion probe - the operator guessed a plausible internal package name and squatted it public. Boilerplate CWE-506, no IOCs. Treat as full RCE against any private-registry proxy that ever fell through to public with a matching internal name.

Registry state

All 13 packages yanked from their respective registries during the 2026-08-24 takedown window. Private mirrors that cached tarballs before takedown will keep serving them.

Related tracked activity

• 2026-08-boto4 PyPI cryptominer-worm operator (Cluster B): now on brand rotation - libasync 2026-08-20 → boto4 2026-08-22 → cryptgraphy/mlflow-otel-instrumentor (this file). Same worm + miner shape, same operator, fresh brand every 24-48h.
• 999.9.x dep-confusion sentinel-version pattern (Cluster C): also seen in stillm4ddpocs-* 2026-08-23 and lumen-pages-community@9.9.9 2026-08-22.
• *`@opap/` scope targeting** (Cluster D): first appearance of OPAP as a dep-confusion target on any tracked ecosystem. If you operate in the EU regulated-gambling space, review your private-scope hygiene against all major operators (Bet365, William Hill, Betsson, OPAP, Stoiximan) - these scopes are cheap to squat.
• Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, kam193. No named threat actor.

Affected packages (12)

Impact

• Cluster A - PyPI envprovision Snow Stealer Windows infostealer (2026-08-24, 3 versions): envprovision@1.2.0, 1.3.0, 1.4.0 (GHSA-xr9j-7gjp-x8fg, source hash cf3a48b4…d869, VT file hash d49fa539…b878, campaign Snow Stealer). Windows-specific dropper. Malicious functionality hidden inside exported library functions so a defender scanning for a top-level os.system() misses it. On import (Windows only): downloads and installs a remote executable, disguises it as a system utility so a casual msconfig / Task Manager review misses it, then cleans logs and removes the downloaded stager to defeat forensic recovery. Payload identified as Snow Stealer - a Windows infostealer that (a) enumerates browser data (Chrome, Edge, Brave, Firefox saved logins, cookies, autofill), (b) modifies cryptowallet application binaries so subsequent transaction-signing flows leak keys, (c) implements multiple sandbox-evasion checks (process list, mouse-movement heuristics, VM-tell registry keys) so dynamic analysis has to actively fight the sample. Any Windows host that ran pip install envprovision needs re-imaging plus wallet-key rotation before restoring
• Cluster B - PyPI cryptgraphy+mlflow-otel-instrumentor cryptominer worm - 2026-08-boto4 operator continuation (2026-08-23, 2 packages): cryptgraphy@>=1.0.0 (GHSA-2v43-g59q-gxp6, source hash d303a7fa…3a1a, VT file hash 051f8704…12e9), mlflow-otel-instrumentor@>=1.1.0 (GHSA-w427-8xgw-fvcw, source hash 596b37ce…0bbf, VT file hash 051f8704…12e9 identical to cryptgraphy, campaign 2026-08-mlflow-otel-instrumentor, explicit similarity to 2026-08-boto4). Both packages ship the same downloaded executable (identical VT file hash) so a scanner that flagged boto4 earlier this week should already be tuned for this file. Payload targets: (1) persistence via systemd services (Linux-native, not Windows Run keys - so this is targeting build/deploy Linux hosts, not developer laptops), (2) XMR-shape cryptomining, (3) worm-style propagation over the local network (see boto4 2026-08-22 for the shared worm shape). Two typosquat targets: cryptography (the widely-used pyca crypto library) and mlflow + opentelemetry (a plausible extension to the mlflow tracing story). The naming discipline (real ecosystem name + real adjacent tech) points to an operator with dictionary preparation, not opportunistic spray
• *Cluster C - npm `fund- 999.9.12 dep-confusion beacon pair (2026-08-23, 2 packages)**: fund-list-filter@999.9.12 (GHSA-ww7v-m7hw-7m2q, hash d7cde5bd…8281), fund-portfolio@999.9.12 (GHSA-8qph-p7jr-c2xf, hash ffad2f6c…03bf). Both share the **999.9.12 dep-confusion sentinel version** and the boilerplate "The package communicates with a domain associated with malicious activity" indicator. Fund-industry naming (fund-list, fund-portfolio`) points to a targeted probe against a specific asset-management or fintech internal registry - any resolver misconfigured to prefer highest-version-across-registries picks the public tarball over a lower-versioned internal one. GHSA does not publish the specific callback domain per package, but the shared version pattern + shared advisory shape confirms a single operator running a two-package catchment probe
• Cluster D - npm @opap/player-kyc-widget OPAP (Greek gambling operator) targeted KYC dep-confusion (2026-08-23, 1 package): @opap/player-kyc-widget@<=3.999.999 (GHSA-w2m6-3q96-chrf, hash 98e627ce…6885). Highly targeted: the @opap scope reads as OPAP (Organisation of Football Prognostics S.A., Greece's dominant regulated gambling operator - sports betting, lottery, casino). player-kyc-widget implies a Know-Your-Customer identity-verification UI component - the exact flow that receives customer ID documents, selfies, and bank-account references during onboarding. The <=3.999.999 version pattern is the classic dep-confusion sentinel: any OPAP resolver misconfigured to prefer highest-version-across-registries picks the public tarball over any lower-versioned internal @opap/player-kyc-widget. Advisory notes "the package communicates with a domain associated with malicious activity" but does not publish the specific callback. Any successful catchment gives the operator a live foothold inside the KYC pipeline of a regulated gambling operator - the payoff on a follow-up payload would be direct access to unredacted customer PII and possibly session cookies for the KYC verifier
• *Cluster E - npm `-dim-kit framework-adjacent typosquat pair (2026-08-23, 2 packages)**: hydration-dim-kit@>=0 (GHSA-p33f-w7x3-mxrr, no per-package IOCs), svelte-dim-kit@>=0 (GHSA-64x3-8jmm-fhp8, no per-package IOCs). Both are boilerplate CWE-506 pulls where GHSA published only the standard "considered fully compromised" text. Naming reads as **framework hydration helpers**: hydration-dim-kit (React/Next.js SSR hydration), svelte-dim-kit (Svelte SSR). The shared -dim-kit` suffix + same publication day strongly suggests a single operator running a two-shot typosquat register against SSR-adjacent dev tooling. Treat as full RCE against any host that installed either
• *Cluster F - npm `@sdgdfgdfhhhfd/ mash-scope disposable-operator pair (2026-08-23, 2 packages)**: @sdgdfgdfhhhfd/multiviewr@>=0 (GHSA-wwgv-4qvc-7339, no per-package IOCs), @sdgdfgdfhhhfd/chainvista@>=0 (GHSA-849m-c6hc-74xx, no per-package IOCs). The scope @sdgdfgdfhhhfd is a **keyboard-mash disposable throwaway** - no legitimate publisher owns that scope, and the pattern (multiviewr = crypto multi-viewer, chainvista` = blockchain viewer) targets crypto-wallet users searching for portfolio-tracking UIs. Boilerplate CWE-506 pulls, no per-package IOCs published. Same operator across both slugs. Any host that installed either should treat wallet keys as leaked
• Cluster G - npm conversa-sdk 10-version maintainer-takeover or long-form typosquat (2026-08-24, 1 package): conversa-sdk@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.8, 1.0.9, 2.0.0, 2.0.2, 2.0.3, 2.0.4 (GHSA-8m82-6fp4-38m4, no per-package IOCs). Ten affected versions spanning both a 1.x and a 2.x release train is the fingerprint of either (a) an established package whose maintainer was compromised and all releases republished with malware, or (b) a long-running typosquat of a real "conversa" chatbot/CX SDK where the operator kept version-bumping to catch scanners tracking a specific version. GHSA published no per-package IOCs. Treat every host that installed any listed version as fully compromised, and check publish dates on the affected versions against your first-install date to scope exposure
• Cluster H - npm identitysecuretokenserv internal-name dep-confusion pull (2026-08-24, 1 package): identitysecuretokenserv@>=0 (GHSA-2g7g-rqj2-26hv, no per-package IOCs). The slug (identity + secure + token + serv = "identity secure token server") matches the fingerprint of an internal-microservice-name dep-confusion probe - the operator guessed a plausible internal package name that some organisation might publish to a private scope, and squatted it public so a misconfigured resolver picks the public one. Boilerplate CWE-506 pull, no IOCs. Treat as full RCE against any private-registry proxy that ever fell through to public with a matching internal name

What to do

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: envprovision, cryptgraphy, mlflow-otel-instrumentor, fund-list-filter, fund-portfolio, @opap/player-kyc-widget, hydration-dim-kit, svelte-dim-kit, @sdgdfgdfhhhfd/multiviewr, @sdgdfgdfhhhfd/chainvista, conversa-sdk, identitysecuretokenserv
2. 2For Cluster A (envprovision Snow Stealer): any Windows host that ran pip install envprovision needs to be re-imaged - the dropper cleans its own logs, so post-hoc forensic recovery is unreliable. Before rebuilding, rotate every credential in every browser saved-password store, every cryptocurrency wallet seed, every VPN cred, every SSH key on the host. If the host holds hot wallets, assume funds are drained - transfer any remaining balance to a fresh wallet generated on a known-clean machine. Add the VT file hash d49fa539…b878 to endpoint AV / EDR blocklists. The Snow Stealer family also modifies wallet application binaries so any wallet software installed after the compromise cannot be trusted - reinstall from vendor sources
3. 3For Cluster B (cryptgraphy + mlflow-otel-instrumentor): uninstall from every virtualenv and CI pipeline. Because the payload propagates worm-style across the local network (shared shape with boto4 2026-08-22), isolate the L2 segment before rebuilding: check every other host on the same subnet for the same VT file hash 051f8704…12e9. Persistence lives in systemd unit files on Linux - systemctl list-unit-files --state=enabled | grep -v '/lib/systemd' for enabled units in unexpected paths (/tmp, /var/tmp, ~/.config/systemd/user, /etc/systemd/system/*.service added in the last 7 days); disable and delete any that reference an executable in a user or tmp directory. If Nvidia GPUs are attached to the host, check GPU utilisation and process list - the cryptominer will show sustained non-zero GPU load without a matching workload
4. 4For Cluster C (fund-list-filter + fund-portfolio): if you operate a private npm registry with a fund-* scope, lock your private-registry proxy to explicit-scope-only resolution so a 999.9.12 public tarball cannot beat your internal semver. Audit the private-registry logs for other fund-* resolutions in the last 90 days. The 999.9.x sentinel-version pattern also matches the stillm4ddpocs-* cluster from 2026-08-23 and the lumen-pages-community@9.9.9 beacon from 2026-08-22 - if your registry has been surveyed by multiple 999.x.x probes, treat it as an active dep-confusion catchment and audit your recent installs
5. 5For Cluster D (@opap/player-kyc-widget): if you operate near OPAP infrastructure or use any @opap/* scope in a private registry, lock private-registry resolution to explicit-scope-only immediately - the version pattern <=3.999.999 is designed to beat any legitimate 3.x/4.x internal version. Audit private-registry logs for any @opap/* resolutions in the last 90 days from outside the corporate egress; treat any match as evidence of a successful dep-confusion catch. Because the target is a KYC pipeline, factor regulatory disclosure obligations (Greek DPA / GDPR / EU gambling regulator) into the incident response if a customer-data path is affected
6. 6*For Cluster E (`-dim-kit`)**: uninstall from every project. Because GHSA published no runtime IOCs, monitor egress from any host that installed either package for outbound connections to previously-unseen domains for at least 30 days
7. 7*For Cluster F (`@sdgdfgdfhhhfd/`)**: uninstall. Watch for republishes under adjacent throwaway scopes - a mash-scope operator that publishes two packages under one scope is trivially rebuildable under another mash-scope for the next batch
8. 8For Cluster G (conversa-sdk): uninstall every listed version. Because ten versions across two release trains are affected, check your install timeline: any version pulled between the first affected release and today should be treated as compromised. Rotate credentials the install shell could reach; if the package was consumed at runtime by a customer-facing service, rebuild from the last known-clean version (which may be prior to the entire affected range if this is a maintainer takeover)
9. 9For Cluster H (identitysecuretokenserv): block at your registry proxy. Because the name matches an internal-microservice fingerprint, audit any private-registry identity* or *-token-serv* resolutions from outside the corporate egress in the last 90 days
10. 10For all npm installs in CI, run with --ignore-scripts where possible - though for Clusters C/D/G, the payload may fire on require()/import rather than lifecycle hooks, so --ignore-scripts alone is insufficient. For all pip install runs, prefer --only-binary=:all: (Clusters A and B both ship native/executable stagers so binary-only is not automatically safe) and pin transitive dependencies from a curated allow-list
11. 11Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

• GHSA-xr9j-7gjp-x8fg - envprovision (PyPI Snow Stealer Windows infostealer)

  github.com
  GitHub
• GHSA-2v43-g59q-gxp6 - cryptgraphy (PyPI cryptominer + worm, 2026-08-boto4 operator continuation)

  github.com
  GitHub
• GHSA-w427-8xgw-fvcw - mlflow-otel-instrumentor (PyPI cryptominer + worm, identical payload to cryptgraphy)

  github.com
  GitHub
• GHSA-ww7v-m7hw-7m2q - fund-list-filter (npm 999.9.12 dep-confusion beacon)

  github.com
  GitHub
• GHSA-8qph-p7jr-c2xf - fund-portfolio (npm 999.9.12 dep-confusion beacon)

  github.com
  GitHub
• GHSA-w2m6-3q96-chrf - @opap/player-kyc-widget (npm OPAP-targeted KYC dep-confusion)

  github.com
  GitHub
• GHSA-p33f-w7x3-mxrr - hydration-dim-kit (npm framework typosquat)

  github.com
  GitHub
• GHSA-64x3-8jmm-fhp8 - svelte-dim-kit (npm framework typosquat)

  github.com
  GitHub
• GHSA-wwgv-4qvc-7339 - @sdgdfgdfhhhfd/multiviewr (npm mash-scope crypto viewer)

  github.com
  GitHub
• GHSA-849m-c6hc-74xx - @sdgdfgdfhhhfd/chainvista (npm mash-scope crypto viewer)

  github.com
  GitHub
• GHSA-8m82-6fp4-38m4 - conversa-sdk (npm 10-version compromised release)

  github.com
  GitHub
• GHSA-2g7g-rqj2-26hv - identitysecuretokenserv (npm internal-name dep-confusion pull)

  github.com
  GitHub
• GitHub Advisory Database - recent npm malware advisories

  github.com
  GitHub
• GitHub Advisory Database - recent pip malware advisories

  github.com
  GitHub
• Related: 2026-08-22 sweep (boto4 Telegram-C2 miner + worm, same operator as Cluster B)

  github.com
  GitHub