DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 25 Aug 202610 packages · 5 versions

GitHub Advisory malware sweep - 2026-08-25 batch (PyPI `msrcpoc` 99.1.9 OpenSSF PA malicious-command detonation + PyPI `multyproccess` `multiprocess` typosquat infostealer with browser/wallet/clipboard theft + npm boilerplate CWE-506 spray of 8 disposable throwaway names)

Summary

10 new GHSA CWE-506 advisories in the 24h ending 2026-08-25. Highlights: PyPI msrcpoc@99.1.9 looks like a 99.x.x dep-confusion / Microsoft MSRC-lookalike probe; PyPI multyproccess is a multiprocess typosquat with a full-featured browser/wallet/clipboard infostealer; the 8 npm entries are boilerplate throwaway names with no per-package IOCs.

dependency-confusioninfostealercredential-thefttyposquatcrypto-wallet-drain
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis
Also known as
2026-08-25 GHSA sweep · msrcpoc MSRC lookalike · multyproccess multiprocess typosquat · 2026-08-multyproccess campaign
Ecosystems
npmPyPI
Packages tracked
10

What happened

The 24-hour window ending 2026-08-25 06:00 UTC published 8 new GHSA CWE-506 advisories on npm and 1 on PyPI (msrcpoc), plus a catch-up entry for 1 PyPI advisory dated 2026-08-24 (multyproccess) that landed after the previous sweep window closed. Only two entries in this batch carry defender-actionable detail: msrcpoc (name-based social-engineering targeting analysts) and multyproccess (a full-featured multiprocess typosquat infostealer). The 8 npm entries are boilerplate throwaway names that look like OpenSSF Package Analysis catches on test/spam accounts rather than a targeted campaign.

Cluster A - PyPI msrcpoc 99.1.9 (1 package)

| Package | Versions | GHSA | Source hash | Notes | |---|---|---|---|---| | msrcpoc | 99.1.9 | GHSA-gx7j-f7w4-8rwp | 57de2918…09df0 | OpenSSF PA: "commands associated with malicious behavior" |

Name-based social engineering: msrcpoc reads as Microsoft Security Response Center proof-of-concept - the exact string an analyst investigating a Microsoft advisory might casually pip install. The 99.1.9 version pattern is the classic dep-confusion sentinel (any resolver misconfigured to prefer highest-version-across-registries picks this over a lower-versioned internal one). GHSA did not publish the specific payload command, only OpenSSF PA's verdict that install-time commands are malicious. Treat as full RCE on any host that installed it, with elevated priority on security-analyst workstations because the operator is fishing for exactly those.

Cluster B - PyPI multyproccess multiprocess typosquat infostealer (1 package, 4 versions)

| Package | Versions | GHSA | Source hash | Campaign | |---|---|---|---|---| | multyproccess | 2.32.3, 2.32.4, 2.32.5, 2.32.6 | GHSA-32gv-h6qj-hjm8 | 93a751dc…f660 | 2026-08-multyproccess |

Published 2026-08-24, missed from the 2026-08-24 sweep window. Attack chain (per GHSA and OpenSSF PA):

  • Overridden setup.py install command executes the infostealer during pip install (before any application code)
  • Data exfil targets: browser saved passwords/cookies/autofill (Chrome, Edge, Brave, Firefox), cryptocurrency wallet keys/seeds, continuous clipboard monitoring for pasted secrets
  • Persistence established on host after initial exfil
  • Sandbox-detection routines to defeat dynamic analysis

The typosquat target is multiprocess (widely-used Python library for parallel processing) - the substitution is i->y plus a doubled c, easy to miss on typo. Version numbers 2.32.3-2.32.6 deliberately mirror recent multiprocess releases so a resolver returning "the version we asked for" completes the install cleanly. Any developer or CI job that ran pip install multyproccess should treat the host as compromised: rotate browser saved credentials, transfer any hot wallet funds off, audit clipboard for pasted secrets.

Cluster C - npm boilerplate CWE-506 spray (8 packages)

| Package | GHSA | Note | |---|---|---| | tungtungisgoated | GHSA-xv9m-378j-86x3 | Boilerplate, no IOCs | | iamhungryrn | GHSA-chwh-2rv3-4c2f | Boilerplate, no IOCs | | whatsgoodlookingbabycreed | GHSA-3jr7-rgw6-prgf | Boilerplate, no IOCs | | pleasedoyourhomework | GHSA-w62m-775m-86f2 | Boilerplate, no IOCs | | sonsonsahur | GHSA-xv2p-qw82-6xmj | Boilerplate, no IOCs | | superdupertest111 | GHSA-99f7-924m-fp2c | Boilerplate, no IOCs | | iwantaburger | GHSA-gcgg-jh5v-64hh | Boilerplate, no IOCs | | classwork | GHSA-776h-qpf5-rx46 | Boilerplate, no IOCs |

All >=0, all pure CWE-506 boilerplate ("considered fully compromised"). The name pattern (joke phrases, keyboard mash, student-throwaway names like classwork and superdupertest111) fits OpenSSF Package Analysis catches on spam / bored-student / test accounts rather than a targeted campaign. Treat as any other CWE-506 pull - uninstall and rotate credentials - but do not spend response effort on attribution.

Registry state

All 10 packages yanked from their respective registries during the 2026-08-25 takedown window. Private mirrors that cached tarballs before takedown will keep serving them.

Related tracked activity

Affected packages (10)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • Cluster A - PyPI msrcpoc 99.1.9 OpenSSF PA malicious-command detonation (2026-08-25, 1 package): msrcpoc@99.1.9 (GHSA-gx7j-f7w4-8rwp, source hash 57de2918e25798c84b17d6a743fbadb99a5e564b8ea34e1ab5d4a0ff6d509df0). OpenSSF Package Analysis flagged the package as executing "one or more commands associated with malicious behavior" during install. The version number 99.1.9 is the classic dep-confusion sentinel-version pattern, and the name reads as a Microsoft MSRC (Security Response Center) proof-of-concept lookalike - the operator likely built the name to look like a legitimate Microsoft security proof-of-concept in the hope a curious analyst pip-installs it. No detailed payload analysis published beyond the OpenSSF PA verdict. Treat any host that ran pip install msrcpoc as compromised at the level of shell-command execution, and pay particular attention if the install ran on a security researcher workstation that also holds MSRC or vendor incident data
  • Cluster B - PyPI multyproccess full-featured infostealer typosquat of multiprocess (2026-08-24, 1 package, 4 versions - missed in the 2026-08-24 sweep window): multyproccess@2.32.3, 2.32.4, 2.32.5, 2.32.6 (GHSA-32gv-h6qj-hjm8, source hash 93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660, campaign 2026-08-multyproccess). Attack chain: overridden setup.py install command executes an infostealer during pip install (before any application code the user wrote runs). Data exfil targets: (1) browser data (saved passwords, cookies, autofill from major browsers), (2) cryptocurrency wallets, (3) clipboard contents monitored continuously. The dropper also establishes persistence on the host and includes sandbox-detection to evade dynamic analysis. Typosquat target multiprocess is a widely-used Python library for process pooling (a common typo miss: multiprocess vs multyproccess - swaps i->y and doubles the c). Version numbers 2.32.3-2.32.6 deliberately mirror recent legitimate multiprocess releases so a resolver seeing "the version we asked for" completes the install cleanly. Any developer who ran pip install multyproccess should treat the host as compromised: rotate browser saved credentials, transfer any hot wallet funds to a fresh wallet on a clean machine, and audit clipboard history for pasted credentials during the install-to-detection window
  • Cluster C - npm boilerplate CWE-506 spray, 8 disposable throwaway names (2026-08-25, no per-package IOCs): tungtungisgoated, iamhungryrn, whatsgoodlookingbabycreed, pleasedoyourhomework, sonsonsahur, superdupertest111, iwantaburger, classwork (GHSA-xv9m-378j-86x3, chwh-2rv3-4c2f, 3jr7-rgw6-prgf, w62m-775m-86f2, xv2p-qw82-6xmj, 99f7-924m-fp2c, gcgg-jh5v-64hh, 776h-qpf5-rx46 respectively). All are >=0 version ranges with only the standard GHSA "considered fully compromised" boilerplate published - no per-package hashes, no per-package IOCs, no campaign attribution. The naming pattern (joke phrases, keyboard mash, homework-style throwaways) matches OpenSSF Package Analysis catches on test / spam / bored-student accounts rather than a targeted campaign. Treat exactly the same as any other CWE-506 pull: uninstall and rotate credentials on any host that installed one, but do not spend response effort attributing this to a real operator

What to do

  1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, package-lock.json, yarn.lock, pnpm-lock.yaml) for: msrcpoc, multyproccess, tungtungisgoated, iamhungryrn, whatsgoodlookingbabycreed, pleasedoyourhomework, sonsonsahur, superdupertest111, iwantaburger, classwork
  2. 2For Cluster A (msrcpoc): uninstall from every virtualenv. Because the name is a Microsoft MSRC lookalike, review any security researcher, red-teamer, or incident-responder workstation with special care - the operator specifically built the name to catch an analyst who would pip install msrcpoc while researching a Microsoft advisory. Rotate any MSRC portal credentials, Microsoft partner tokens, or vendor incident tooling credentials on any host that installed it. The 99.1.9 sentinel version also means any private mirror configured to prefer highest-version-across-registries would pick this over an internal msrcpoc if one existed - audit private-registry logs
  3. 3For Cluster B (multyproccess): any host that ran pip install multyproccess should be treated as compromised at infostealer level. Rotate browser-saved credentials in every profile on that host (Chrome, Edge, Brave, Firefox saved logins, cookies, autofill, saved cards). Transfer any cryptocurrency wallet balances to a fresh wallet generated on a known-clean machine before touching the compromised host. Audit clipboard history for pasted credentials in the window between install and detection. Check for persistence artifacts: cron entries, systemd user units, Windows Run keys, LaunchAgents. Add source hash 93a751dc…f660 to endpoint scanning tools. Verify the multiprocess package (the legitimate one) is what appears in your resolved dependencies; the visual similarity is exactly the failure mode this typosquat exploits
  4. 4*For Cluster C (`is-goated / iamhungryrn / iwantaburger / etc.`)**: uninstall from any project. Because GHSA published no runtime IOCs for these, monitor outbound egress from any host that installed one for previously-unseen domains for at least 30 days. Do not expend attribution effort - these look like spam/throwaway names
  5. 5For all pip install runs in CI, prefer --only-binary=:all: (Clusters A and B both use setup.py install overrides, so this specifically blocks the install-time code path - and unlike some setup.py-only exploits, both packages are already source-only tarballs) and pin transitive dependencies from a curated allow-list
  6. 6For all npm install runs in CI, run with --ignore-scripts where possible; for Cluster C the specific execution path is unknown so --ignore-scripts alone may not stop the payload if it fires on require()/import
  7. 7Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-25-ghsa-malware-sweep