# GitHub Advisory malware sweep, 26 August 2026

> 28 new GHSA CWE-506 advisories in the 48h window ending 2026-08-26. Highlights: PyPI `envprovision` drops "Snow Stealer" browser/wallet infostealer with sandbox evasion; PyPI `minecraft-ytreceiver` runs webcam/screenshot/keylogger over Telegram C2; PyPI `python-walletlibr-v` fires a Windows batch dropper at pip install; npm `twork-data-services-*` and `wm-*` clusters look like internal-namespace dep-confusion probes; a 15-package Vue/Svelte/Vite lookalike cluster and 5 CWE-506 boilerplate names round out the batch.

- Published: 2026-08-26
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 28 packages, 11 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, dependency-confusion, typosquat, dns-exfiltration, obfuscation
- Also known as: 2026-08-26 GHSA sweep, 2026-08-envprovision campaign, 2026-08-minecraft-ytreceiver campaign, Snow Stealer PyPI, twork-data-services dep-confusion, wm-* internal-namespace dep-confusion
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis
- Incident ID: multi-2026-08-26-ghsa-malware-sweep

## Affected packages (28)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [array-shuffler-utils-99](https://dependencywatch.io/package/npm/array-shuffler-utils-99) | npm |  |
| [dim-hydration-ui](https://dependencywatch.io/package/npm/dim-hydration-ui) | npm |  |
| [dim-svelte-ui](https://dependencywatch.io/package/npm/dim-svelte-ui) | npm |  |
| [envprovision](https://dependencywatch.io/package/pypi/envprovision) | PyPI | 1.2.0, 1.3.0, 1.4.0 |
| [express-security-policy](https://dependencywatch.io/package/npm/express-security-policy) | npm |  |
| [fivem-tool-helper](https://dependencywatch.io/package/npm/fivem-tool-helper) | npm |  |
| [fivem-tool-helper-v2](https://dependencywatch.io/package/npm/fivem-tool-helper-v2) | npm |  |
| [foldmap](https://dependencywatch.io/package/npm/foldmap) | npm |  |
| [hexdrift](https://dependencywatch.io/package/npm/hexdrift) | npm |  |
| [hydration-cls-ui](https://dependencywatch.io/package/npm/hydration-cls-ui) | npm |  |
| [hydration-ui-cls](https://dependencywatch.io/package/npm/hydration-ui-cls) | npm |  |
| [minecraft-ytreceiver](https://dependencywatch.io/package/pypi/minecraft-ytreceiver) | PyPI | 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0 |
| [python-walletlibr-v](https://dependencywatch.io/package/pypi/python-walletlibr-v) | PyPI | 0.7.9 |
| [renovate-config-doctolib](https://dependencywatch.io/package/npm/renovate-config-doctolib) | npm |  |
| [snapbuf](https://dependencywatch.io/package/npm/snapbuf) | npm |  |
| [svelte-cls-ui](https://dependencywatch.io/package/npm/svelte-cls-ui) | npm |  |
| [svelte-ui-cls](https://dependencywatch.io/package/npm/svelte-ui-cls) | npm |  |
| [twork-data-services-proxy-prime-api-v1-account-overdraft-info](https://dependencywatch.io/package/npm/twork-data-services-proxy-prime-api-v1-account-overdraft-info) | npm | 20.7.4 |
| [twork-data-services-sme-operations-authorizations](https://dependencywatch.io/package/npm/twork-data-services-sme-operations-authorizations) | npm | 20.8.9 |
| [vite-plugin-cleaner](https://dependencywatch.io/package/npm/vite-plugin-cleaner) | npm |  |
| [vite-plugin-logo](https://dependencywatch.io/package/npm/vite-plugin-logo) | npm |  |
| [vite-plugin-model](https://dependencywatch.io/package/npm/vite-plugin-model) | npm |  |
| [vortnode](https://dependencywatch.io/package/npm/vortnode) | npm |  |
| [vue-compiler-sfc-plugin](https://dependencywatch.io/package/npm/vue-compiler-sfc-plugin) | npm |  |
| [vue-template-compiler-plugin](https://dependencywatch.io/package/npm/vue-template-compiler-plugin) | npm |  |
| [wm-eslint-fe](https://dependencywatch.io/package/npm/wm-eslint-fe) | npm |  |
| [wm-idp-sdk](https://dependencywatch.io/package/npm/wm-idp-sdk) | npm |  |
| [wm-lib-env-provider](https://dependencywatch.io/package/npm/wm-lib-env-provider) | npm |  |

## What happened

The 48-hour window ending 2026-08-26 06:00 UTC published **28 new GHSA CWE-506 advisories**: 3 on PyPI (all with substantive infostealer/spyware payloads), 25 on npm (20 dated 2026-08-25 that landed after the previous sweep window closed, 5 dated 2026-08-26). The three PyPI entries are all defender-actionable with source hashes and payload detail; the npm entries include two coherent internal-namespace dep-confusion clusters (`twork-data-services-*` and `wm-*`), a 15-package Vue/Svelte/Vite ecosystem lookalike burst, and 5 CWE-506 boilerplate names published today.

## Cluster A - PyPI `envprovision` Snow Stealer (3 versions)

| Package | Versions | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `envprovision` | `1.2.0, 1.3.0, 1.4.0` | GHSA-xr9j-7gjp-x8fg | `cf3a48b4…d869` | `2026-08-envprovision` |

Exported functions hide the harmful activity from casual inspection. On Windows the package fetches a remote executable disguised as a legitimate system tool; the binary self-identifies as **Snow Stealer**, an infostealer with sandbox-evasion routines and heavy obfuscation that harvests browser data (saved credentials, cookies, autofill, session tokens) and targets cryptocurrency wallet applications. Post-execution the payload wipes logs and deletes temp files to erase forensic breadcrumbs - so "we did not find IOCs on disk" is not a clean signal on an installing host.

## Cluster B - PyPI `minecraft-ytreceiver` Telegram-C2 surveillance (5 versions)

| Package | Versions | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `minecraft-ytreceiver` | `0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0` | GHSA-cj4w-748x-8w4q | `af6c2393…175e` | `2026-08-minecraft-ytreceiver` |

Full surveillance kit: webcam capture, periodic screenshots, arbitrary-file exfiltration, continuous keystroke logging, all beaconed and controlled via a Telegram bot channel. The `minecraft-yt*` name targets Minecraft server hobbyists / YouTube-tutorial followers rather than enterprise developers - a Telegram-controlled RAT deployed against home users. Webcam-capable devices in shared spaces should be assumed to have captured footage during the exposure window.

## Cluster C - PyPI `python-walletlibr-v` Windows batch dropper (1 version)

| Package | Versions | GHSA | Source hash |
|---|---|---|---|
| `python-walletlibr-v` | `0.7.9` | GHSA-pfrw-v3ch-6m8x | `6783cffe…220c` |

Masquerades as wallet software with stub-only user-facing code. On Windows install, writes a batch file to `%TEMP%`, spawns a new command console, and runs arbitrary system commands (published PoC spawns `calc.exe` as a harmless indicator; the same channel can execute anything). Name matches the `python-wallet*-v` pattern used by prior 2026 wallet-theft typosquats.

## Cluster D - npm `twork-data-services-*` internal-scope dep-confusion (2 packages)

| Package | Version | GHSA |
|---|---|---|
| `twork-data-services-proxy-prime-api-v1-account-overdraft-info` | `= 20.7.4` | GHSA-crw8-m6mj-q6qp |
| `twork-data-services-sme-operations-authorizations` | `<= 20.8.9` | GHSA-c4f8-h585-2c73 |

The name pattern (`twork-data-services-<internal-service>-<domain>-<endpoint>`), the SME / overdraft banking domain vocabulary, and the specific `20.x` version numbers that mimic a mature internal-registry version line are the classic dep-confusion sentinel triple: guess an internal name, cover the exact version an internal resolver would look up, publish to public npm and wait for a mis-scoped install.

## Cluster E - npm `wm-*` internal-namespace dep-confusion (3 packages)

| Package | GHSA |
|---|---|
| `wm-eslint-fe` | GHSA-59qg-7f2g-4p3c |
| `wm-idp-sdk` | GHSA-hq9q-4jgc-997v |
| `wm-lib-env-provider` | GHSA-54m9-xjx6-pf8x |

`wm-<function>-<scope>` naming (frontend eslint config, IDP SDK, env-provider library) reads like a private company's internal-package prefix. All `>= 0`, all CWE-506 boilerplate. No per-package hashes.

## Cluster F - npm Vue/Svelte/Vite plugin lookalike burst (15 packages)

| Package | GHSA | Note |
|---|---|---|
| `vue-template-compiler-plugin` | GHSA-gvmg-cf54-7769 | Vue toolchain lookalike |
| `vue-compiler-sfc-plugin` | GHSA-v29w-qjvw-fm35 | `@vue/compiler-sfc` namespace confusion |
| `svelte-ui-cls` | GHSA-q88r-gcjf-c3jc | Svelte CLS/UI namespace |
| `svelte-cls-ui` | GHSA-f6cw-gvwj-gw7f | Svelte CLS/UI namespace |
| `dim-svelte-ui` | GHSA-w5m9-548m-c928 | Svelte CLS/UI namespace |
| `hydration-ui-cls` | GHSA-596w-j9vp-pr5x | hydration/CLS lookalike |
| `dim-hydration-ui` | GHSA-6797-g855-4767 | hydration/CLS lookalike |
| `hydration-cls-ui` | GHSA-q635-2q7j-grxm | hydration/CLS lookalike |
| `vite-plugin-model` | GHSA-p58m-2wrh-74xr | `vite-plugin-*` namespace |
| `vite-plugin-logo` | GHSA-cw37-h4jm-63xh | `vite-plugin-*` namespace |
| `vite-plugin-cleaner` | GHSA-rx9h-69c4-qhq5 | `vite-plugin-*` namespace |
| `hexdrift` | GHSA-4p5f-gmxw-44x3 | Short generic name, same burst |
| `vortnode` | GHSA-c3fw-fh7f-9h58 | Short generic name, same burst |
| `foldmap` | GHSA-q4hh-v9hg-92w7 | Short generic name, same burst |
| `snapbuf` | GHSA-82xg-f5h2-7xf8 | Short generic name, same burst |

All `>= 0`, all CWE-506 boilerplate ("considered fully compromised"). The cluster shape (Vue + Svelte + Vite hydration ecosystem in one batch, plus 4 generic short names) points to one operator publishing a plausibly-searchable frontend-tooling name burst. `vue-template-compiler-plugin` and `vue-compiler-sfc-plugin` read as legitimate build-tool add-ons and are the highest-risk of the 15.

## Cluster G - npm CWE-506 boilerplate (2026-08-26, 5 packages)

| Package | GHSA | Note |
|---|---|---|
| `renovate-config-doctolib` | GHSA-8327-2h3c-rm8g | Renovate preset lookalike (highest priority in this cluster) |
| `express-security-policy` | GHSA-3hxc-wppf-m25r | Express CSP-middleware lookalike |
| `array-shuffler-utils-99` | GHSA-22jp-536p-wwgr | `99` trailing token matches sentinel-version dep-confusion pattern |
| `fivem-tool-helper` | GHSA-7jgv-5jq7-38g6 | FiveM (GTA mod) tooling lookalike |
| `fivem-tool-helper-v2` | GHSA-qgxc-chq8-gvrg | Twin publish, same target |

All `>= 0`, all CWE-506 boilerplate. `renovate-config-doctolib` is the highest-priority because Renovate `extends:` chains routinely pull shared presets from public npm - a mis-scoped resolve puts malicious config into every repo consuming the preset.

## Registry state

All 28 packages yanked from their respective registries during the 2026-08-25 / 2026-08-26 takedown windows. Private mirrors that cached tarballs before takedown will keep serving them.

## Related tracked activity

- **`99.x.x` and trailing-`99` sentinel-version dep-confusion pattern** (Cluster G `array-shuffler-utils-99`): continues the pattern from [`msrcpoc@99.1.9` 2026-08-25](https://dependencywatch.io/incident/multi-2026-08-25-ghsa-malware-sweep), [`stillm4ddpocs-*` 2026-08-23](https://dependencywatch.io/incident/multi-2026-08-23-ghsa-malware-sweep), [`lumen-pages-community@9.9.9` 2026-08-22](https://dependencywatch.io/incident/multi-2026-08-22-ghsa-malware-sweep), and [`fund-list-filter`/`fund-portfolio@999.9.12` 2026-08-24](https://dependencywatch.io/incident/multi-2026-08-24-ghsa-malware-sweep).
- **PyPI infostealer with sandbox evasion + log wiping** (Cluster A `envprovision` Snow Stealer): the "hide inside exported functions + evasion + log cleanup" combo repeats a pattern seen across the 2026-08 PyPI batches; audit any PyPI package added in the last 30 days for the same shape.
- **Wallet-theft `python-wallet*-v` PyPI typosquat pattern** (Cluster C): the trailing `-v` and misspelled `-libr-` are recurring wallet-theft typosquat tells; verify any `python-wallet*` import against the exact expected package name before use.
- **Telegram-bot C2 for Python malware** (Cluster B `minecraft-ytreceiver`): Telegram Bot API is a recurring easy C2 channel because outbound `api.telegram.org` traffic passes most home / small-office egress filters unnoticed. Any host with unexplained `api.telegram.org` outbound after a PyPI install deserves a look.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages` (kam193), `OpenSSF Package Analysis`. No named threat actor.

## Impact

- **Cluster A - PyPI `envprovision` Snow Stealer infostealer (2026-08-24 -> published 2026-08-25, 1 package, 3 versions)**: `envprovision@1.2.0, 1.3.0, 1.4.0` (GHSA-xr9j-7gjp-x8fg, source hash `cf3a48b407852ec03ead22bb8c16c03f252ba5fafa5c86ed1a739427e7d7d869`, campaign `2026-08-envprovision`). Attack chain: exported functions hide the harmful activity from casual inspection; on Windows the package downloads and executes a remote binary disguised as a legitimate system tool; the binary self-identifies as **Snow Stealer**, an infostealer with sandbox-evasion routines and heavy obfuscation that harvests browser data (saved credentials, cookies, autofill, session tokens) and targets cryptocurrency wallet applications; post-execution the payload wipes logs and deletes temp files to erase forensic breadcrumbs. Any Windows host that ran `pip install envprovision` should be treated as compromised at infostealer level: rotate every browser-saved credential, transfer any hot-wallet funds off from a clean host, and hunt for the remote-executable filename in Windows Defender / EDR history even though the on-disk artifact is likely gone by the time you look
- **Cluster B - PyPI `minecraft-ytreceiver` Telegram-C2 webcam + keylogger + file-stealer (2026-08-25, 1 package, 5 versions)**: `minecraft-ytreceiver@0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0` (GHSA-cj4w-748x-8w4q, source hash `af6c2393210af3735a9353f40789859af7f87c96bcbd00178df62edb2ff7175e`, campaign `2026-08-minecraft-ytreceiver`). The payload is a full surveillance kit: webcam capture, periodic screenshots, arbitrary-file exfiltration, and continuous keystroke logging, all beaconed and controlled via a Telegram bot channel used for command-and-control and data exfil. The `minecraft-yt*` name suggests the operator targeted Minecraft server hobbyists / YouTube-tutorial followers rather than enterprise developers, but exposure is the same: any host that installed one of these five versions is a live keylogger with a webcam. Priority-1 remediation - webcam-capable devices in shared spaces (household desktop, streamer rig, shared studio) should be assumed to have footage of everything in front of the camera during the exposure window
- **Cluster C - PyPI `python-walletlibr-v` Windows batch dropper at install time (2026-08-25, 1 package, 1 version)**: `python-walletlibr-v@0.7.9` (GHSA-pfrw-v3ch-6m8x, source hash `6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c`). The package masquerades as wallet software with stub-only user-facing code; during install on Windows it writes a batch file to `%TEMP%`, spawns a new command console, and runs arbitrary system commands (the published PoC harmlessly spawns `calc.exe` as a proof but the same channel can execute anything). The name matches the "python-wallet*-v" pattern used by prior 2026 wallet-theft typosquats. Windows hosts that ran `pip install python-walletlibr-v` should be treated as running an unknown attacker-chosen command with the installing user's privileges
- **Cluster D - npm `twork-data-services-*` internal-namespace dep-confusion cluster (2026-08-25, 2 packages, 2 versions)**: `twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4` (GHSA-crw8-m6mj-q6qp) and `twork-data-services-sme-operations-authorizations` <= `20.8.9` (GHSA-c4f8-h585-2c73). The name pattern (`twork-data-services-<internal-service>-<domain>-<endpoint>`), the SME / overdraft banking domain vocabulary, and the specific `20.x` version numbers (20.7.4 and 20.8.9) that mimic a mature internal-registry version line are the classic dep-confusion sentinel triple: guess an internal name, cover the exact version an internal resolver would look up, publish to public npm and wait for a mis-scoped install. Any org with an internal npm package named `twork-*` should audit their private registry for accidental hits from public-registry lookups during this window, and audit `npm install --loglevel silly` traces for the specific full names
- **Cluster E - npm `wm-*` internal-namespace dep-confusion cluster (2026-08-25, 3 packages)**: `wm-eslint-fe` (GHSA-59qg-7f2g-4p3c), `wm-idp-sdk` (GHSA-hq9q-4jgc-997v), `wm-lib-env-provider` (GHSA-54m9-xjx6-pf8x), all `>= 0`. The `wm-<function>-<scope>` naming (frontend eslint config, IDP SDK, env-provider library) reads like a private company's internal-package prefix. No per-package hashes published beyond the CWE-506 boilerplate. Orgs whose internal npm registry uses a `wm-*` prefix should audit for any accidental public resolution during the exposure window
- **Cluster F - npm Vue / Svelte / Vite plugin lookalike cluster (2026-08-25, 15 packages)**: `vue-template-compiler-plugin` (GHSA-gvmg-cf54-7769), `vue-compiler-sfc-plugin` (GHSA-v29w-qjvw-fm35) - lookalikes of `vue-template-compiler` and `@vue/compiler-sfc`; `svelte-ui-cls` (GHSA-q88r-gcjf-c3jc), `svelte-cls-ui` (GHSA-f6cw-gvwj-gw7f), `dim-svelte-ui` (GHSA-w5m9-548m-c928), `hydration-ui-cls` (GHSA-596w-j9vp-pr5x), `dim-hydration-ui` (GHSA-6797-g855-4767), `hydration-cls-ui` (GHSA-q635-2q7j-grxm) - CLS/UI namespace lookalikes riding on the Svelte / hydration ecosystem; `vite-plugin-model` (GHSA-p58m-2wrh-74xr), `vite-plugin-logo` (GHSA-cw37-h4jm-63xh), `vite-plugin-cleaner` (GHSA-rx9h-69c4-qhq5) - `vite-plugin-*` namespace squatting; `hexdrift` (GHSA-4p5f-gmxw-44x3), `vortnode` (GHSA-c3fw-fh7f-9h58), `foldmap` (GHSA-q4hh-v9hg-92w7), `snapbuf` (GHSA-82xg-f5h2-7xf8) - short generic-sounding names that fit the same publishing burst. All `>= 0`, all CWE-506 boilerplate ("considered fully compromised"), no per-package IOCs published. The cluster shape (Vue + Svelte + Vite hydration ecosystem in one batch, plus 4 generic short names) suggests one operator publishing a burst of plausibly-searchable frontend-tooling names hoping a developer typo-installs one instead of the real `@vue/*` / `svelte-*` / `vite-plugin-*` package. Treat as any other CWE-506 pull
- **Cluster G - npm boilerplate CWE-506 (2026-08-26, 5 packages)**: `renovate-config-doctolib` (GHSA-8327-2h3c-rm8g) - Renovate shared-config lookalike that could ride into any repo consuming shared Renovate presets; `express-security-policy` (GHSA-3hxc-wppf-m25r) - Express middleware lookalike, name reads like a legitimate CSP middleware; `array-shuffler-utils-99` (GHSA-22jp-536p-wwgr) - trailing `99` matches the `99.x.x` sentinel-version dep-confusion pattern seen in prior sweeps; `fivem-tool-helper` (GHSA-7jgv-5jq7-38g6) and `fivem-tool-helper-v2` (GHSA-qgxc-chq8-gvrg) - twin publications targeting the FiveM (GTA multiplayer mod) tooling ecosystem, matching the same pattern as prior game-mod supply-chain lures. All `>= 0`, no per-package hashes published beyond the standard GHSA boilerplate. `renovate-config-doctolib` is the highest-priority of the five - any org that consumes Renovate presets from a `doctolib` scope internally could accidentally resolve the public malicious variant

## What to do

1. Grep every lockfile (`requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for: `envprovision`, `minecraft-ytreceiver`, `python-walletlibr-v`, `twork-data-services-proxy-prime-api-v1-account-overdraft-info`, `twork-data-services-sme-operations-authorizations`, `wm-eslint-fe`, `wm-idp-sdk`, `wm-lib-env-provider`, `vue-template-compiler-plugin`, `vue-compiler-sfc-plugin`, `svelte-ui-cls`, `svelte-cls-ui`, `dim-svelte-ui`, `hydration-ui-cls`, `dim-hydration-ui`, `hydration-cls-ui`, `vite-plugin-model`, `vite-plugin-logo`, `vite-plugin-cleaner`, `hexdrift`, `vortnode`, `foldmap`, `snapbuf`, `renovate-config-doctolib`, `express-security-policy`, `array-shuffler-utils-99`, `fivem-tool-helper`, `fivem-tool-helper-v2`
2. **For Cluster A (`envprovision` Snow Stealer)**: any Windows host that installed one of `1.2.0`/`1.3.0`/`1.4.0` should be treated as compromised at infostealer level. **Rotate all browser saved credentials, cookies, session tokens, and MFA seeds** on every profile on that host. Rotate cryptocurrency wallet keys if any wallet application ran on that host. Because the payload wipes logs and deletes temp artifacts, do NOT rely on "we did not find IOCs on disk" as a clean signal - the malware's design is specifically to make that check useless. Push source hash `cf3a48b4…d869` to endpoint scanning; hunt for the "Snow Stealer" family in EDR retrospective queries
3. **For Cluster B (`minecraft-ytreceiver`)**: any host that installed 0.1.0-0.5.0 is a live keylogger with a webcam feed. **Webcam-capable devices in shared spaces are the priority-1 concern** - a household desktop, streamer rig, or shared studio machine should be assumed to have footage of everything in front of the camera during the install-to-detection window. Rotate credentials for every service accessed from the compromised host (keylogger has captured them). Wipe the host and reinstall from clean media; the Telegram-C2 channel means the operator has arbitrary follow-on execution and simple removal is inadequate. Push source hash `af6c2393…175e` to endpoint scanning
4. **For Cluster C (`python-walletlibr-v`)**: any Windows host that ran `pip install python-walletlibr-v==0.7.9` should be treated as having run an unknown attacker-chosen command with the installing user's privileges. Rotate any Windows-user-scoped credentials, check `%TEMP%` history for the batch dropper artifact (likely deleted by now), and hunt for the source hash `6783cffe…220c` in EDR retrospective queries. Any wallet software the user installed and unlocked during the same session should have its keys rotated / funds moved from a clean host
5. **For Clusters D and E (`twork-data-services-*`, `wm-*` internal-namespace guesses)**: orgs whose internal npm registry uses a `twork-*` or `wm-*` prefix should audit private-registry logs for accidental public-registry resolution during the exposure window. The specific `20.7.4` and `20.8.9` versions on `twork-data-services-*` suggest the operator knows or guessed the target's internal versioning line - treat as targeted dep-confusion. Configure npm to resolve internal names via `--registry=<internal>` only, or use scoped names to make dep-confusion impossible in the first place
6. **For Cluster F (Vue/Svelte/Vite lookalikes)**: uninstall any that landed and rotate credentials on the installing host. When adding `vue-*` / `svelte-*` / `vite-plugin-*` packages, verify the exact publisher against the real `@vue`, `svelte`, or vite-plugin ecosystem publisher before install; small typos and namespace confusion are exactly the failure mode this cluster exploits. `vue-template-compiler-plugin` and `vue-compiler-sfc-plugin` in particular read as legitimate build-tool packages
7. **For Cluster G (2026-08-26 boilerplate)**: `renovate-config-doctolib` is the highest-risk of the batch because Renovate preset resolution can pull the malicious variant into every repo consuming the preset. Any org whose Renovate shared config lives under a `doctolib` GitHub org or npm scope should audit `renovate.json` `extends:` chains for public-registry resolution. `express-security-policy` reads as a legitimate CSP middleware - developers hand-searching for CSP helpers may install it by mistake; verify against `helmet` and similar established middleware
8. For all `pip install` runs in CI, prefer `--only-binary=:all:` - Clusters A, B, C all execute at install time (either via `setup.py`/wheel side-effects or through overridden setup commands) and a wheels-only install with hash-pinning to a known-good hash is the reliable block
9. For all `npm install` runs in CI, run with `--ignore-scripts` where possible; Cluster F entries publish no per-package IOCs so the specific execution path is unknown and `--ignore-scripts` alone may not stop a payload that fires on `require()`/`import`
10. Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-xr9j-7gjp-x8fg - envprovision (PyPI Snow Stealer Windows infostealer, browser + wallet)](https://github.com/advisories/GHSA-xr9j-7gjp-x8fg) - GitHub
- [GHSA-cj4w-748x-8w4q - minecraft-ytreceiver (PyPI webcam + screenshot + keylogger + file steal via Telegram C2)](https://github.com/advisories/GHSA-cj4w-748x-8w4q) - GitHub
- [GHSA-pfrw-v3ch-6m8x - python-walletlibr-v (PyPI Windows batch dropper, install-time arbitrary command execution)](https://github.com/advisories/GHSA-pfrw-v3ch-6m8x) - GitHub
- [GHSA-crw8-m6mj-q6qp - twork-data-services-proxy-prime-api-v1-account-overdraft-info@20.7.4 (npm internal-scope dep-confusion probe)](https://github.com/advisories/GHSA-crw8-m6mj-q6qp) - GitHub
- [GHSA-c4f8-h585-2c73 - twork-data-services-sme-operations-authorizations (npm internal-scope dep-confusion probe)](https://github.com/advisories/GHSA-c4f8-h585-2c73) - GitHub
- [GHSA-59qg-7f2g-4p3c - wm-eslint-fe (npm wm-* internal-namespace dep-confusion)](https://github.com/advisories/GHSA-59qg-7f2g-4p3c) - GitHub
- [GHSA-hq9q-4jgc-997v - wm-idp-sdk (npm wm-* internal-namespace dep-confusion)](https://github.com/advisories/GHSA-hq9q-4jgc-997v) - GitHub
- [GHSA-54m9-xjx6-pf8x - wm-lib-env-provider (npm wm-* internal-namespace dep-confusion)](https://github.com/advisories/GHSA-54m9-xjx6-pf8x) - GitHub
- [GHSA-gvmg-cf54-7769 - vue-template-compiler-plugin (npm Vue lookalike)](https://github.com/advisories/GHSA-gvmg-cf54-7769) - GitHub
- [GHSA-v29w-qjvw-fm35 - vue-compiler-sfc-plugin (npm @vue/compiler-sfc lookalike)](https://github.com/advisories/GHSA-v29w-qjvw-fm35) - GitHub
- [GHSA-q88r-gcjf-c3jc - svelte-ui-cls (npm Svelte CLS/UI cluster)](https://github.com/advisories/GHSA-q88r-gcjf-c3jc) - GitHub
- [GHSA-f6cw-gvwj-gw7f - svelte-cls-ui (npm Svelte CLS/UI cluster)](https://github.com/advisories/GHSA-f6cw-gvwj-gw7f) - GitHub
- [GHSA-w5m9-548m-c928 - dim-svelte-ui (npm Svelte CLS/UI cluster)](https://github.com/advisories/GHSA-w5m9-548m-c928) - GitHub
- [GHSA-596w-j9vp-pr5x - hydration-ui-cls (npm hydration/CLS cluster)](https://github.com/advisories/GHSA-596w-j9vp-pr5x) - GitHub
- [GHSA-6797-g855-4767 - dim-hydration-ui (npm hydration/CLS cluster)](https://github.com/advisories/GHSA-6797-g855-4767) - GitHub
- [GHSA-q635-2q7j-grxm - hydration-cls-ui (npm hydration/CLS cluster)](https://github.com/advisories/GHSA-q635-2q7j-grxm) - GitHub
- [GHSA-p58m-2wrh-74xr - vite-plugin-model (npm vite-plugin-* namespace squatting)](https://github.com/advisories/GHSA-p58m-2wrh-74xr) - GitHub
- [GHSA-cw37-h4jm-63xh - vite-plugin-logo (npm vite-plugin-* namespace squatting)](https://github.com/advisories/GHSA-cw37-h4jm-63xh) - GitHub
- [GHSA-rx9h-69c4-qhq5 - vite-plugin-cleaner (npm vite-plugin-* namespace squatting)](https://github.com/advisories/GHSA-rx9h-69c4-qhq5) - GitHub
- [GHSA-4p5f-gmxw-44x3 - hexdrift (npm generic-name burst)](https://github.com/advisories/GHSA-4p5f-gmxw-44x3) - GitHub
- [GHSA-c3fw-fh7f-9h58 - vortnode (npm generic-name burst)](https://github.com/advisories/GHSA-c3fw-fh7f-9h58) - GitHub
- [GHSA-q4hh-v9hg-92w7 - foldmap (npm generic-name burst)](https://github.com/advisories/GHSA-q4hh-v9hg-92w7) - GitHub
- [GHSA-82xg-f5h2-7xf8 - snapbuf (npm generic-name burst)](https://github.com/advisories/GHSA-82xg-f5h2-7xf8) - GitHub
- [GHSA-8327-2h3c-rm8g - renovate-config-doctolib (npm Renovate preset lookalike)](https://github.com/advisories/GHSA-8327-2h3c-rm8g) - GitHub
- [GHSA-3hxc-wppf-m25r - express-security-policy (npm Express CSP-middleware lookalike)](https://github.com/advisories/GHSA-3hxc-wppf-m25r) - GitHub
- [GHSA-22jp-536p-wwgr - array-shuffler-utils-99 (npm sentinel-99 dep-confusion probe)](https://github.com/advisories/GHSA-22jp-536p-wwgr) - GitHub
- [GHSA-7jgv-5jq7-38g6 - fivem-tool-helper (npm FiveM/GTA mod tooling lookalike)](https://github.com/advisories/GHSA-7jgv-5jq7-38g6) - GitHub
- [GHSA-qgxc-chq8-gvrg - fivem-tool-helper-v2 (npm FiveM/GTA mod tooling lookalike, twin publish)](https://github.com/advisories/GHSA-qgxc-chq8-gvrg) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).