# GitHub Advisory malware sweep, 25 August 2026

> 10 new GHSA CWE-506 advisories in the 24h ending 2026-08-25. Highlights: PyPI `msrcpoc@99.1.9` looks like a 99.x.x dep-confusion / Microsoft MSRC-lookalike probe; PyPI `multyproccess` is a `multiprocess` typosquat with a full-featured browser/wallet/clipboard infostealer; the 8 npm entries are boilerplate throwaway names with no per-package IOCs.

- Published: 2026-08-25
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 10 packages, 5 compromised versions
- Tags: dependency-confusion, infostealer, credential-theft, typosquat, crypto-wallet-drain
- Also known as: 2026-08-25 GHSA sweep, msrcpoc MSRC lookalike, multyproccess multiprocess typosquat, 2026-08-multyproccess campaign
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis
- Incident ID: multi-2026-08-25-ghsa-malware-sweep

## Affected packages (10)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [classwork](https://dependencywatch.io/package/npm/classwork) | npm |  |
| [iamhungryrn](https://dependencywatch.io/package/npm/iamhungryrn) | npm |  |
| [iwantaburger](https://dependencywatch.io/package/npm/iwantaburger) | npm |  |
| [msrcpoc](https://dependencywatch.io/package/pypi/msrcpoc) | PyPI | 99.1.9 |
| [multyproccess](https://dependencywatch.io/package/pypi/multyproccess) | PyPI | 2.32.3, 2.32.4, 2.32.5, 2.32.6 |
| [pleasedoyourhomework](https://dependencywatch.io/package/npm/pleasedoyourhomework) | npm |  |
| [sonsonsahur](https://dependencywatch.io/package/npm/sonsonsahur) | npm |  |
| [superdupertest111](https://dependencywatch.io/package/npm/superdupertest111) | npm |  |
| [tungtungisgoated](https://dependencywatch.io/package/npm/tungtungisgoated) | npm |  |
| [whatsgoodlookingbabycreed](https://dependencywatch.io/package/npm/whatsgoodlookingbabycreed) | npm |  |

## What happened

The 24-hour window ending 2026-08-25 06:00 UTC published **8 new GHSA CWE-506 advisories on npm** and **1 on PyPI** (`msrcpoc`), plus a catch-up entry for **1 PyPI advisory dated 2026-08-24** (`multyproccess`) that landed after the previous sweep window closed. Only two entries in this batch carry defender-actionable detail: `msrcpoc` (name-based social-engineering targeting analysts) and `multyproccess` (a full-featured `multiprocess` typosquat infostealer). The 8 npm entries are boilerplate throwaway names that look like OpenSSF Package Analysis catches on test/spam accounts rather than a targeted campaign.

## Cluster A - PyPI `msrcpoc` 99.1.9 (1 package)

| Package | Versions | GHSA | Source hash | Notes |
|---|---|---|---|---|
| `msrcpoc` | `99.1.9` | GHSA-gx7j-f7w4-8rwp | `57de2918…09df0` | OpenSSF PA: "commands associated with malicious behavior" |

Name-based social engineering: `msrcpoc` reads as **Microsoft Security Response Center proof-of-concept** - the exact string an analyst investigating a Microsoft advisory might casually `pip install`. The `99.1.9` version pattern is the classic dep-confusion sentinel (any resolver misconfigured to prefer highest-version-across-registries picks this over a lower-versioned internal one). GHSA did not publish the specific payload command, only OpenSSF PA's verdict that install-time commands are malicious. Treat as full RCE on any host that installed it, with elevated priority on security-analyst workstations because the operator is fishing for exactly those.

## Cluster B - PyPI `multyproccess` `multiprocess` typosquat infostealer (1 package, 4 versions)

| Package | Versions | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `multyproccess` | `2.32.3, 2.32.4, 2.32.5, 2.32.6` | GHSA-32gv-h6qj-hjm8 | `93a751dc…f660` | `2026-08-multyproccess` |

Published 2026-08-24, missed from the 2026-08-24 sweep window. Attack chain (per GHSA and OpenSSF PA):

- Overridden `setup.py install` command executes the infostealer **during `pip install`** (before any application code)
- Data exfil targets: browser saved passwords/cookies/autofill (Chrome, Edge, Brave, Firefox), cryptocurrency wallet keys/seeds, continuous clipboard monitoring for pasted secrets
- Persistence established on host after initial exfil
- Sandbox-detection routines to defeat dynamic analysis

The typosquat target is `multiprocess` (widely-used Python library for parallel processing) - the substitution is `i`->`y` plus a doubled `c`, easy to miss on typo. Version numbers `2.32.3-2.32.6` deliberately mirror recent `multiprocess` releases so a resolver returning "the version we asked for" completes the install cleanly. Any developer or CI job that ran `pip install multyproccess` should treat the host as compromised: rotate browser saved credentials, transfer any hot wallet funds off, audit clipboard for pasted secrets.

## Cluster C - npm boilerplate CWE-506 spray (8 packages)

| Package | GHSA | Note |
|---|---|---|
| `tungtungisgoated` | GHSA-xv9m-378j-86x3 | Boilerplate, no IOCs |
| `iamhungryrn` | GHSA-chwh-2rv3-4c2f | Boilerplate, no IOCs |
| `whatsgoodlookingbabycreed` | GHSA-3jr7-rgw6-prgf | Boilerplate, no IOCs |
| `pleasedoyourhomework` | GHSA-w62m-775m-86f2 | Boilerplate, no IOCs |
| `sonsonsahur` | GHSA-xv2p-qw82-6xmj | Boilerplate, no IOCs |
| `superdupertest111` | GHSA-99f7-924m-fp2c | Boilerplate, no IOCs |
| `iwantaburger` | GHSA-gcgg-jh5v-64hh | Boilerplate, no IOCs |
| `classwork` | GHSA-776h-qpf5-rx46 | Boilerplate, no IOCs |

All `>=0`, all pure CWE-506 boilerplate ("considered fully compromised"). The name pattern (joke phrases, keyboard mash, student-throwaway names like `classwork` and `superdupertest111`) fits OpenSSF Package Analysis catches on spam / bored-student / test accounts rather than a targeted campaign. Treat as any other CWE-506 pull - uninstall and rotate credentials - but do not spend response effort on attribution.

## Registry state

All 10 packages yanked from their respective registries during the 2026-08-25 takedown window. Private mirrors that cached tarballs before takedown will keep serving them.

## Related tracked activity

- **`99.x.x` sentinel-version dep-confusion pattern** (Cluster A): also seen in [`stillm4ddpocs-*` 2026-08-23](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep), [`lumen-pages-community@9.9.9` 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep), and [`fund-list-filter`/`fund-portfolio@999.9.12` 2026-08-24](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep).
- **`multi` -> `multy` PyPI typosquat pattern** (Cluster B): the phonetic-preservation substitution (`multi` -> `multy`) is a recurring PyPI typosquat trick; audit any internal `multi*` package usage against exact-name expectation.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`. No named threat actor.

## Impact

- **Cluster A - PyPI `msrcpoc` 99.1.9 OpenSSF PA malicious-command detonation (2026-08-25, 1 package)**: `msrcpoc@99.1.9` (GHSA-gx7j-f7w4-8rwp, source hash `57de2918e25798c84b17d6a743fbadb99a5e564b8ea34e1ab5d4a0ff6d509df0`). OpenSSF Package Analysis flagged the package as executing "one or more commands associated with malicious behavior" during install. The version number `99.1.9` is the classic dep-confusion sentinel-version pattern, and the name reads as a Microsoft MSRC (Security Response Center) proof-of-concept lookalike - the operator likely built the name to look like a legitimate Microsoft security proof-of-concept in the hope a curious analyst pip-installs it. No detailed payload analysis published beyond the OpenSSF PA verdict. Treat any host that ran `pip install msrcpoc` as compromised at the level of shell-command execution, and pay particular attention if the install ran on a security researcher workstation that also holds MSRC or vendor incident data
- **Cluster B - PyPI `multyproccess` full-featured infostealer typosquat of `multiprocess` (2026-08-24, 1 package, 4 versions - missed in the 2026-08-24 sweep window)**: `multyproccess@2.32.3, 2.32.4, 2.32.5, 2.32.6` (GHSA-32gv-h6qj-hjm8, source hash `93a751dcfb2e5ac6058cbd62220d237288d3ceb4d8fe152b7ef7babb645df660`, campaign `2026-08-multyproccess`). Attack chain: overridden `setup.py install` command **executes an infostealer during pip install** (before any application code the user wrote runs). Data exfil targets: (1) browser data (saved passwords, cookies, autofill from major browsers), (2) cryptocurrency wallets, (3) clipboard contents monitored continuously. The dropper also establishes persistence on the host and includes sandbox-detection to evade dynamic analysis. Typosquat target `multiprocess` is a widely-used Python library for process pooling (a common typo miss: `multiprocess` vs `multyproccess` - swaps `i`->`y` and doubles the `c`). Version numbers `2.32.3-2.32.6` deliberately mirror recent legitimate `multiprocess` releases so a resolver seeing "the version we asked for" completes the install cleanly. Any developer who ran `pip install multyproccess` should treat the host as compromised: rotate browser saved credentials, transfer any hot wallet funds to a fresh wallet on a clean machine, and audit clipboard history for pasted credentials during the install-to-detection window
- **Cluster C - npm boilerplate CWE-506 spray, 8 disposable throwaway names (2026-08-25, no per-package IOCs)**: `tungtungisgoated`, `iamhungryrn`, `whatsgoodlookingbabycreed`, `pleasedoyourhomework`, `sonsonsahur`, `superdupertest111`, `iwantaburger`, `classwork` (GHSA-xv9m-378j-86x3, chwh-2rv3-4c2f, 3jr7-rgw6-prgf, w62m-775m-86f2, xv2p-qw82-6xmj, 99f7-924m-fp2c, gcgg-jh5v-64hh, 776h-qpf5-rx46 respectively). All are `>=0` version ranges with only the standard GHSA "considered fully compromised" boilerplate published - no per-package hashes, no per-package IOCs, no campaign attribution. The naming pattern (joke phrases, keyboard mash, homework-style throwaways) matches OpenSSF Package Analysis catches on test / spam / bored-student accounts rather than a targeted campaign. Treat exactly the same as any other CWE-506 pull: uninstall and rotate credentials on any host that installed one, but do not spend response effort attributing this to a real operator

## What to do

1. Grep every lockfile (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for: `msrcpoc`, `multyproccess`, `tungtungisgoated`, `iamhungryrn`, `whatsgoodlookingbabycreed`, `pleasedoyourhomework`, `sonsonsahur`, `superdupertest111`, `iwantaburger`, `classwork`
2. **For Cluster A (`msrcpoc`)**: uninstall from every virtualenv. Because the name is a **Microsoft MSRC lookalike**, review any security researcher, red-teamer, or incident-responder workstation with special care - the operator specifically built the name to catch an analyst who would `pip install msrcpoc` while researching a Microsoft advisory. Rotate any MSRC portal credentials, Microsoft partner tokens, or vendor incident tooling credentials on any host that installed it. The `99.1.9` sentinel version also means any private mirror configured to prefer highest-version-across-registries would pick this over an internal `msrcpoc` if one existed - audit private-registry logs
3. **For Cluster B (`multyproccess`)**: any host that ran `pip install multyproccess` should be treated as compromised at infostealer level. **Rotate browser-saved credentials** in every profile on that host (Chrome, Edge, Brave, Firefox saved logins, cookies, autofill, saved cards). **Transfer any cryptocurrency wallet balances** to a fresh wallet generated on a known-clean machine before touching the compromised host. Audit clipboard history for pasted credentials in the window between install and detection. Check for persistence artifacts: cron entries, systemd user units, Windows Run keys, LaunchAgents. Add source hash `93a751dc…f660` to endpoint scanning tools. Verify the `multiprocess` package (the legitimate one) is what appears in your resolved dependencies; the visual similarity is exactly the failure mode this typosquat exploits
4. **For Cluster C (`*is-goated / iamhungryrn / iwantaburger / etc.`)**: uninstall from any project. Because GHSA published no runtime IOCs for these, monitor outbound egress from any host that installed one for previously-unseen domains for at least 30 days. Do not expend attribution effort - these look like spam/throwaway names
5. For all `pip install` runs in CI, prefer `--only-binary=:all:` (Clusters A and B both use `setup.py install` overrides, so this specifically blocks the install-time code path - and unlike some `setup.py`-only exploits, both packages are already source-only tarballs) and pin transitive dependencies from a curated allow-list
6. For all `npm install` runs in CI, run with `--ignore-scripts` where possible; for Cluster C the specific execution path is unknown so `--ignore-scripts` alone may not stop the payload if it fires on `require()`/`import`
7. Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-gx7j-f7w4-8rwp - msrcpoc (PyPI MSRC-lookalike malicious-command payload)](https://github.com/advisories/GHSA-gx7j-f7w4-8rwp) - GitHub
- [GHSA-32gv-h6qj-hjm8 - multyproccess (PyPI multiprocess typosquat infostealer with wallet/browser/clipboard theft)](https://github.com/advisories/GHSA-32gv-h6qj-hjm8) - GitHub
- [GHSA-xv9m-378j-86x3 - tungtungisgoated (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-xv9m-378j-86x3) - GitHub
- [GHSA-chwh-2rv3-4c2f - iamhungryrn (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-chwh-2rv3-4c2f) - GitHub
- [GHSA-3jr7-rgw6-prgf - whatsgoodlookingbabycreed (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-3jr7-rgw6-prgf) - GitHub
- [GHSA-w62m-775m-86f2 - pleasedoyourhomework (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-w62m-775m-86f2) - GitHub
- [GHSA-xv2p-qw82-6xmj - sonsonsahur (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-xv2p-qw82-6xmj) - GitHub
- [GHSA-99f7-924m-fp2c - superdupertest111 (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-99f7-924m-fp2c) - GitHub
- [GHSA-gcgg-jh5v-64hh - iwantaburger (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-gcgg-jh5v-64hh) - GitHub
- [GHSA-776h-qpf5-rx46 - classwork (npm boilerplate CWE-506)](https://github.com/advisories/GHSA-776h-qpf5-rx46) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-25-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-25-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).