GitHub Advisory malware sweep, 26 August 2026

The full picture

28 packages 11 versions

• npmarray-shuffler-utils-99→
• npmdim-hydration-ui→
• npmdim-svelte-ui→
• PyPIenvprovision1.2.01.3.01.4.0→
• npmexpress-security-policy→
• npmfivem-tool-helper→
• npmfivem-tool-helper-v2→
• npmfoldmap→
• npmhexdrift→
• npmhydration-cls-ui→
• npmhydration-ui-cls→
• PyPIminecraft-ytreceiver0.1.00.2.00.3.00.4.00.5.0→
• PyPIpython-walletlibr-v0.7.9→
• npmrenovate-config-doctolib→
• npmsnapbuf→
• npmsvelte-cls-ui→
• npmsvelte-ui-cls→
• npmtwork-data-services-proxy-prime-api-v1-account-overdraft-info20.7.4→
• npmtwork-data-services-sme-operations-authorizations20.8.9→
• npmvite-plugin-cleaner→
• npmvite-plugin-logo→
• npmvite-plugin-model→
• npmvortnode→
• npmvue-compiler-sfc-plugin→
• npmvue-template-compiler-plugin→
• npmwm-eslint-fe→
• npmwm-idp-sdk→
• npmwm-lib-env-provider→

What it does if you installed it

• Cluster A - PyPI envprovision Snow Stealer infostealer (2026-08-24 -> published 2026-08-25, 1 package, 3 versions): envprovision@1.2.0, 1.3.0, 1.4.0 (GHSA-xr9j-7gjp-x8fg, source hash cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869, campaign 2026-08-envprovision). Attack chain: exported functions hide the harmful activity from casual inspection; on Windows the package downloads and executes a remote binary disguised as a legitimate system tool; the binary self-identifies as Snow Stealer, an infostealer with sandbox-evasion routines and heavy obfuscation that harvests browser data (saved credentials, cookies, autofill, session tokens) and targets cryptocurrency wallet applications; post-execution the payload wipes logs and deletes temp files to erase forensic breadcrumbs. Any Windows host that ran pip install envprovision should be treated as compromised at infostealer level: rotate every browser-saved credential, transfer any hot-wallet funds off from a clean host, and hunt for the remote-executable filename in Windows Defender / EDR history even though the on-disk artifact is likely gone by the time you look
• Cluster B - PyPI minecraft-ytreceiver Telegram-C2 webcam + keylogger + file-stealer (2026-08-25, 1 package, 5 versions): minecraft-ytreceiver@0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0 (GHSA-cj4w-748x-8w4q, source hash af6c2393210af3735a9353f40789859af7f87c96bcbd00178df62edb2ff7175e, campaign 2026-08-minecraft-ytreceiver). The payload is a full surveillance kit: webcam capture, periodic screenshots, arbitrary-file exfiltration, and continuous keystroke logging, all beaconed and controlled via a Telegram bot channel used for command-and-control and data exfil. The minecraft-yt* name suggests the operator targeted Minecraft server hobbyists / YouTube-tutorial followers rather than enterprise developers, but exposure is the same: any host that installed one of these five versions is a live keylogger with a webcam. Priority-1 remediation - webcam-capable devices in shared spaces (household desktop, streamer rig, shared studio) should be assumed to have footage of everything in front of the camera during the exposure window
• Cluster C - PyPI python-walletlibr-v Windows batch dropper at install time (2026-08-25, 1 package, 1 version): python-walletlibr-v@0.7.9 (GHSA-pfrw-v3ch-6m8x, source hash 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c). The package masquerades as wallet software with stub-only user-facing code; during install on Windows it writes a batch file to %TEMP%, spawns a new command console, and runs arbitrary system commands (the published PoC harmlessly spawns calc.exe as a proof but the same channel can execute anything). The name matches the "python-wallet*-v" pattern used by prior 2026 wallet-theft typosquats. Windows hosts that ran pip install python-walletlibr-v should be treated as running an unknown attacker-chosen command with the installing user's privileges
• *Cluster D - npm `twork-data-services- internal-namespace dep-confusion cluster (2026-08-25, 2 packages, 2 versions)**: twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4 (GHSA-crw8-m6mj-q6qp) and twork-data-services-sme-operations-authorizations <= 20.8.9 (GHSA-c4f8-h585-2c73). The name pattern (twork-data-services-<internal-service>-<domain>-<endpoint>), the SME / overdraft banking domain vocabulary, and the specific 20.x version numbers (20.7.4 and 20.8.9) that mimic a mature internal-registry version line are the classic dep-confusion sentinel triple: guess an internal name, cover the exact version an internal resolver would look up, publish to public npm and wait for a mis-scoped install. Any org with an internal npm package named twork-* should audit their private registry for accidental hits from public-registry lookups during this window, and audit npm install --loglevel silly` traces for the specific full names
• *Cluster E - npm `wm- internal-namespace dep-confusion cluster (2026-08-25, 3 packages)**: wm-eslint-fe (GHSA-59qg-7f2g-4p3c), wm-idp-sdk (GHSA-hq9q-4jgc-997v), wm-lib-env-provider (GHSA-54m9-xjx6-pf8x), all >= 0. The wm-<function>-<scope> naming (frontend eslint config, IDP SDK, env-provider library) reads like a private company's internal-package prefix. No per-package hashes published beyond the CWE-506 boilerplate. Orgs whose internal npm registry uses a wm-*` prefix should audit for any accidental public resolution during the exposure window
• Cluster F - npm Vue / Svelte / Vite plugin lookalike cluster (2026-08-25, 15 packages): vue-template-compiler-plugin (GHSA-gvmg-cf54-7769), vue-compiler-sfc-plugin (GHSA-v29w-qjvw-fm35) - lookalikes of vue-template-compiler and @vue/compiler-sfc; svelte-ui-cls (GHSA-q88r-gcjf-c3jc), svelte-cls-ui (GHSA-f6cw-gvwj-gw7f), dim-svelte-ui (GHSA-w5m9-548m-c928), hydration-ui-cls (GHSA-596w-j9vp-pr5x), dim-hydration-ui (GHSA-6797-g855-4767), hydration-cls-ui (GHSA-q635-2q7j-grxm) - CLS/UI namespace lookalikes riding on the Svelte / hydration ecosystem; vite-plugin-model (GHSA-p58m-2wrh-74xr), vite-plugin-logo (GHSA-cw37-h4jm-63xh), vite-plugin-cleaner (GHSA-rx9h-69c4-qhq5) - vite-plugin-* namespace squatting; hexdrift (GHSA-4p5f-gmxw-44x3), vortnode (GHSA-c3fw-fh7f-9h58), foldmap (GHSA-q4hh-v9hg-92w7), snapbuf (GHSA-82xg-f5h2-7xf8) - short generic-sounding names that fit the same publishing burst. All >= 0, all CWE-506 boilerplate ("considered fully compromised"), no per-package IOCs published. The cluster shape (Vue + Svelte + Vite hydration ecosystem in one batch, plus 4 generic short names) suggests one operator publishing a burst of plausibly-searchable frontend-tooling names hoping a developer typo-installs one instead of the real @vue/* / svelte-* / vite-plugin-* package. Treat as any other CWE-506 pull
• Cluster G - npm boilerplate CWE-506 (2026-08-26, 5 packages): renovate-config-doctolib (GHSA-8327-2h3c-rm8g) - Renovate shared-config lookalike that could ride into any repo consuming shared Renovate presets; express-security-policy (GHSA-3hxc-wppf-m25r) - Express middleware lookalike, name reads like a legitimate CSP middleware; array-shuffler-utils-99 (GHSA-22jp-536p-wwgr) - trailing 99 matches the 99.x.x sentinel-version dep-confusion pattern seen in prior sweeps; fivem-tool-helper (GHSA-7jgv-5jq7-38g6) and fivem-tool-helper-v2 (GHSA-qgxc-chq8-gvrg) - twin publications targeting the FiveM (GTA multiplayer mod) tooling ecosystem, matching the same pattern as prior game-mod supply-chain lures. All >= 0, no per-package hashes published beyond the standard GHSA boilerplate. renovate-config-doctolib is the highest-priority of the five - any org that consumes Renovate presets from a doctolib scope internally could accidentally resolve the public malicious variant

Clean-up steps

1. 1Grep every lockfile (requirements.txt, Pipfile.lock, poetry.lock, uv.lock, package-lock.json, yarn.lock, pnpm-lock.yaml) for: envprovision, minecraft-ytreceiver, python-walletlibr-v, twork-data-services-proxy-prime-api-v1-account-overdraft-info, twork-data-services-sme-operations-authorizations, wm-eslint-fe, wm-idp-sdk, wm-lib-env-provider, vue-template-compiler-plugin, vue-compiler-sfc-plugin, svelte-ui-cls, svelte-cls-ui, dim-svelte-ui, hydration-ui-cls, dim-hydration-ui, hydration-cls-ui, vite-plugin-model, vite-plugin-logo, vite-plugin-cleaner, hexdrift, vortnode, foldmap, snapbuf, renovate-config-doctolib, express-security-policy, array-shuffler-utils-99, fivem-tool-helper, fivem-tool-helper-v2
2. 2For Cluster A (envprovision Snow Stealer): any Windows host that installed one of 1.2.0/1.3.0/1.4.0 should be treated as compromised at infostealer level. Rotate all browser saved credentials, cookies, session tokens, and MFA seeds on every profile on that host. Rotate cryptocurrency wallet keys if any wallet application ran on that host. Because the payload wipes logs and deletes temp artifacts, do NOT rely on "we did not find IOCs on disk" as a clean signal - the malware's design is specifically to make that check useless. Push source hash cf3a48b4…d869 to endpoint scanning; hunt for the "Snow Stealer" family in EDR retrospective queries
3. 3For Cluster B (minecraft-ytreceiver): any host that installed 0.1.0-0.5.0 is a live keylogger with a webcam feed. Webcam-capable devices in shared spaces are the priority-1 concern - a household desktop, streamer rig, or shared studio machine should be assumed to have footage of everything in front of the camera during the install-to-detection window. Rotate credentials for every service accessed from the compromised host (keylogger has captured them). Wipe the host and reinstall from clean media; the Telegram-C2 channel means the operator has arbitrary follow-on execution and simple removal is inadequate. Push source hash af6c2393…175e to endpoint scanning
4. 4For Cluster C (python-walletlibr-v): any Windows host that ran pip install python-walletlibr-v==0.7.9 should be treated as having run an unknown attacker-chosen command with the installing user's privileges. Rotate any Windows-user-scoped credentials, check %TEMP% history for the batch dropper artifact (likely deleted by now), and hunt for the source hash 6783cffe…220c in EDR retrospective queries. Any wallet software the user installed and unlocked during the same session should have its keys rotated / funds moved from a clean host
5. 5*For Clusters D and E (`twork-data-services-, wm-` internal-namespace guesses): orgs whose internal npm registry uses a `twork- or wm- prefix should audit private-registry logs for accidental public-registry resolution during the exposure window. The specific 20.7.4 and 20.8.9 versions on twork-data-services- suggest the operator knows or guessed the target's internal versioning line - treat as targeted dep-confusion. Configure npm to resolve internal names via --registry=<internal>` only, or use scoped names to make dep-confusion impossible in the first place
6. 6For Cluster F (Vue/Svelte/Vite lookalikes): uninstall any that landed and rotate credentials on the installing host. When adding vue-* / svelte-* / vite-plugin-* packages, verify the exact publisher against the real @vue, svelte, or vite-plugin ecosystem publisher before install; small typos and namespace confusion are exactly the failure mode this cluster exploits. vue-template-compiler-plugin and vue-compiler-sfc-plugin in particular read as legitimate build-tool packages
7. 7For Cluster G (2026-08-26 boilerplate): renovate-config-doctolib is the highest-risk of the batch because Renovate preset resolution can pull the malicious variant into every repo consuming the preset. Any org whose Renovate shared config lives under a doctolib GitHub org or npm scope should audit renovate.json extends: chains for public-registry resolution. express-security-policy reads as a legitimate CSP middleware - developers hand-searching for CSP helpers may install it by mistake; verify against helmet and similar established middleware
8. 8For all pip install runs in CI, prefer --only-binary=:all: - Clusters A, B, C all execute at install time (either via setup.py/wheel side-effects or through overridden setup commands) and a wheels-only install with hash-pinning to a known-good hash is the reliable block
9. 9For all npm install runs in CI, run with --ignore-scripts where possible; Cluster F entries publish no per-package IOCs so the specific execution path is unknown and --ignore-scripts alone may not stop a payload that fires on require()/import
10. 10Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

Sources

• GHSA-xr9j-7gjp-x8fg - envprovision (PyPI Snow Stealer Windows infostealer, browser + wallet)github.comGitHub
• GHSA-cj4w-748x-8w4q - minecraft-ytreceiver (PyPI webcam + screenshot + keylogger + file steal via Telegram C2)github.comGitHub
• GHSA-pfrw-v3ch-6m8x - python-walletlibr-v (PyPI Windows batch dropper, install-time arbitrary command execution)github.comGitHub
• GHSA-crw8-m6mj-q6qp - twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4 (npm internal-scope dep-confusion probe)github.comGitHub
• GHSA-c4f8-h585-2c73 - twork-data-services-sme-operations-authorizations (npm internal-scope dep-confusion probe)github.comGitHub
• GHSA-59qg-7f2g-4p3c - wm-eslint-fe (npm wm-* internal-namespace dep-confusion)github.comGitHub
• GHSA-hq9q-4jgc-997v - wm-idp-sdk (npm wm-* internal-namespace dep-confusion)github.comGitHub
• GHSA-54m9-xjx6-pf8x - wm-lib-env-provider (npm wm-* internal-namespace dep-confusion)github.comGitHub
• GHSA-gvmg-cf54-7769 - vue-template-compiler-plugin (npm Vue lookalike)github.comGitHub
• GHSA-v29w-qjvw-fm35 - vue-compiler-sfc-plugin (npm @vue/compiler-sfc lookalike)github.comGitHub
• GHSA-q88r-gcjf-c3jc - svelte-ui-cls (npm Svelte CLS/UI cluster)github.comGitHub
• GHSA-f6cw-gvwj-gw7f - svelte-cls-ui (npm Svelte CLS/UI cluster)github.comGitHub
• GHSA-w5m9-548m-c928 - dim-svelte-ui (npm Svelte CLS/UI cluster)github.comGitHub
• GHSA-596w-j9vp-pr5x - hydration-ui-cls (npm hydration/CLS cluster)github.comGitHub
• GHSA-6797-g855-4767 - dim-hydration-ui (npm hydration/CLS cluster)github.comGitHub
• GHSA-q635-2q7j-grxm - hydration-cls-ui (npm hydration/CLS cluster)github.comGitHub
• GHSA-p58m-2wrh-74xr - vite-plugin-model (npm vite-plugin-* namespace squatting)github.comGitHub
• GHSA-cw37-h4jm-63xh - vite-plugin-logo (npm vite-plugin-* namespace squatting)github.comGitHub
• GHSA-rx9h-69c4-qhq5 - vite-plugin-cleaner (npm vite-plugin-* namespace squatting)github.comGitHub
• GHSA-4p5f-gmxw-44x3 - hexdrift (npm generic-name burst)github.comGitHub
• GHSA-c3fw-fh7f-9h58 - vortnode (npm generic-name burst)github.comGitHub
• GHSA-q4hh-v9hg-92w7 - foldmap (npm generic-name burst)github.comGitHub
• GHSA-82xg-f5h2-7xf8 - snapbuf (npm generic-name burst)github.comGitHub
• GHSA-8327-2h3c-rm8g - renovate-config-doctolib (npm Renovate preset lookalike)github.comGitHub
• GHSA-3hxc-wppf-m25r - express-security-policy (npm Express CSP-middleware lookalike)github.comGitHub
• GHSA-22jp-536p-wwgr - array-shuffler-utils-99 (npm sentinel-99 dep-confusion probe)github.comGitHub
• GHSA-7jgv-5jq7-38g6 - fivem-tool-helper (npm FiveM/GTA mod tooling lookalike)github.comGitHub
• GHSA-qgxc-chq8-gvrg - fivem-tool-helper-v2 (npm FiveM/GTA mod tooling lookalike, twin publish)github.comGitHub
• GitHub Advisory Database - recent npm malware advisoriesgithub.comGitHub
• GitHub Advisory Database - recent pip malware advisoriesgithub.comGitHub