# GitHub Advisory malware sweep, 27 August 2026

> 24 new GHSA malware advisories in the 24h window ending 2026-08-27. Highlights: npm `hydration-vli-ui@1.0.0` ships a Linux x86_64 ELF disguised as JavaScript, on import establishes a full-featured RAT with SSH-key theft and systemd persistence; npm `commonjs-code-token` postinstall pulls a token from `access-token-delta.vercel.app` and `eval()`s it; npm `spotify-url-resolvers` archives the project directory (including `.env`) hourly to a Telegram bot; PyPI `pybitjs` is attributed to Lazarus/PolinRider with blockchain-based C2 delivery.

- Published: 2026-08-27
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 24 packages, 19 compromised versions
- Tags: infostealer, credential-theft, crypto-wallet-drain, typosquat, account-takeover, ci-cd-compromise, dns-exfiltration, obfuscation
- Threat actor: Lazarus / PolinRider (attribution for Cluster F `pybitjs` only; other clusters unattributed)
- Also known as: 2026-08-27 GHSA sweep, 2026-08-hydration-vli-ui ELF RAT, 2026-08-commonjs-code-token remote eval, 2026-08-spotify-url-resolvers Telegram exfil, 2026-08-chai-plus taskforge-9xv, 2026-08-pybitjs Lazarus PolinRider, 2025-04-tronix TRX exfil
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-08-27-ghsa-malware-sweep

## Affected packages (24)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [0xfighter3](https://dependencywatch.io/package/pypi/0xfighter3) | PyPI | 0.1 |
| [bigquery-agent-analytics-tracing](https://dependencywatch.io/package/pypi/bigquery-agent-analytics-tracing) | PyPI | 0.0.0, 0.0.1 |
| [bnotify-web-sdk](https://dependencywatch.io/package/npm/bnotify-web-sdk) | npm |  |
| [chai-plus](https://dependencywatch.io/package/npm/chai-plus) | npm | 6.2.3, 6.2.4, 6.2.5 |
| [commonjs-code-token](https://dependencywatch.io/package/npm/commonjs-code-token) | npm | 1.0.0, 1.0.1 |
| [dumb-binding-gyp-package](https://dependencywatch.io/package/npm/dumb-binding-gyp-package) | npm |  |
| [grandfather_of_the_desert](https://dependencywatch.io/package/npm/grandfather_of_the_desert) | npm |  |
| [hydration-vli-ui](https://dependencywatch.io/package/npm/hydration-vli-ui) | npm | 1.0.0 |
| [model-poc-suhail](https://dependencywatch.io/package/npm/model-poc-suhail) | npm |  |
| [node-pino](https://dependencywatch.io/package/npm/node-pino) | npm |  |
| [octopus-action](https://dependencywatch.io/package/npm/octopus-action) | npm | 1.0.0, 1.0.1 |
| [parallely](https://dependencywatch.io/package/npm/parallely) | npm |  |
| [pybitjs](https://dependencywatch.io/package/pypi/pybitjs) | PyPI | 0.1.0 |
| [rce-test](https://dependencywatch.io/package/pypi/rce-test) | PyPI | 0.1 |
| [self-certificates](https://dependencywatch.io/package/npm/self-certificates) | npm |  |
| [self-sign](https://dependencywatch.io/package/npm/self-sign) | npm |  |
| [spotify-url-resolvers](https://dependencywatch.io/package/npm/spotify-url-resolvers) | npm | 3.4.2 |
| [svelte-vli-ui](https://dependencywatch.io/package/npm/svelte-vli-ui) | npm |  |
| [syntaxerror-package-12345](https://dependencywatch.io/package/pypi/syntaxerror-package-12345) | PyPI | 0.1 |
| [taskforge-9xv](https://dependencywatch.io/package/npm/taskforge-9xv) | npm | 1.3.0 |
| [the_tax_free_cashier_is_at_9f](https://dependencywatch.io/package/npm/the_tax_free_cashier_is_at_9f) | npm |  |
| [trongridet](https://dependencywatch.io/package/pypi/trongridet) | PyPI | 0.0.1 |
| [tset_racie](https://dependencywatch.io/package/npm/tset_racie) | npm |  |
| [zenntechinc-cli](https://dependencywatch.io/package/npm/zenntechinc-cli) | npm | 1.6.4, 1.6.6 |

## What happened

The 24-hour window ending 2026-08-27 06:00 UTC published **24 new GHSA malware advisories** on npm and PyPI. Unusually high substantive-payload density: five npm entries and two PyPI entries ship real IOCs (source hashes, C2 endpoints, campaign attributions), the rest are boilerplate CWE-506 fills.

## Cluster A - npm `hydration-vli-ui@1.0.0` ELF-in-JS Linux RAT (highest severity)

| Package | Version | GHSA | Source hash | C2 |
|---|---|---|---|---|
| `hydration-vli-ui` | `1.0.0` | GHSA-8p96-6q9p-xvw5 | `44daff58…7d0480` | `217.60.77.63` |

Linux x86_64 ELF binary disguised as JavaScript. On `import` / `require()`, drops and executes the ELF; the RAT opens a command shell over `/bin/sh` and `/bin/bash`, SOCKS/port-forwarding tunnelling, arbitrary file drop-and-execute, in-memory execution via `memfd_create`, and persistence through **systemd user units**. Exfiltrates SSH private keys, saved credentials, local database files, clipboard contents, environment variables. No authentication required to open the C2.

The `hydration-vli-ui` name extends the same "hydration-*ui" naming burst first seen in the 2026-08-25 sweep (`hydration-ui-cls`, `dim-hydration-ui`, `hydration-cls-ui`) but the ELF-in-JS payload is a categorically bigger threat than the boilerplate CWE-506 siblings in that cluster.

## Cluster B - npm `commonjs-code-token` remote-eval postinstall C2

| Package | Versions | GHSA | Source hash | C2 |
|---|---|---|---|---|
| `commonjs-code-token` | `1.0.0, 1.0.1` | GHSA-wq3w-3cqf-rjjj | `c6ab469a…4883ad` | `access-token-delta.vercel.app` |

Postinstall runs `index.js`, which fetches JSON from `https://access-token-delta.vercel.app` and passes the returned `token` field directly to `eval()`. Cover README copied from `node-cache-multithread`. The `eval()` channel means the operator can serve anything - one hour it is credential theft, the next it is a wallet-drain, the next it is a worm to publish under the maintainer's npm token.

## Cluster C - npm `spotify-url-resolvers` Telegram-C2 project-dir exfil

| Package | Versions | GHSA | Source hash | C2 |
|---|---|---|---|---|
| `spotify-url-resolvers` | `<= 3.4.2` | GHSA-mg73-v34h-w9f9 | `7318f0d7…b1cea` | Telegram bot `8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM`, chat `7549282259` |

On module load, starts an **hourly** loop that ZIPs the project directory (`node_modules` and `.git` excluded, `.env` **included**) and exfiltrates each archive to the Telegram bot. README carries Arabic-language instructions telling the reader to `require()` the module - a social hook rather than a lifecycle-script auto-execute. Any project that landed this package has had every `.env` in the tree captured hourly for the duration of exposure.

## Cluster D - npm `octopus-action` Burp Collaborator preinstall exfil

| Package | Versions | GHSA | Source hash | C2 |
|---|---|---|---|---|
| `octopus-action` | `<= 1.0.1` | GHSA-xp3r-4585-7gx2 | `6968c2a1…4c637f2` | `dfwvktnc563cparn1p88c8051w7ovej3.oastify.com` |

Preinstall lifecycle script POSTs hostname, OS username, home directory, DNS configuration, package metadata, `/etc/passwd`, and `/etc/hosts` to a Burp Collaborator endpoint over HTTPS. Whether the operator is a scoped bounty-hunter or an actor abusing Collaborator as throwaway C2 infrastructure is unknowable from the artefact alone; the leak is the same either way.

## Cluster E - npm `chai-plus` `taskforge-9xv` second-stage installer

| Package | Versions | GHSA | Source hash | Stage-2 C2 |
|---|---|---|---|---|
| `chai-plus` | `6.2.3, 6.2.4, 6.2.5` | GHSA-m5q5-4fx8-hh2m (+ umbrella GHSA-2r27-f59g-4hcx) | `b91b2220…b020d9` | `taskforge-9xv@1.3.0` -> `http://coolblast.zapto.org:8888` |

On import, bootstraps by running `npm install --global taskforge-9xv@1.3.0` and immediately executes it with hardcoded arguments pointing at `http://coolblast.zapto.org:8888` (unencrypted; dynamic-DNS via `zapto.org`) with an embedded token. The `chai` typosquat surface is enormous - `chai` is the default assertion library for Mocha and one of the most-downloaded testing packages on npm.

## Cluster F - PyPI `pybitjs` Lazarus/PolinRider blockchain-C2

| Package | Version | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `pybitjs` | `0.1.0` | GHSA-wv93-5fvj-96j3 | `8cf3b727…23c8` | `2026-08-pybitjs` (Lazarus / PolinRider) |

Obfuscated JavaScript-based malware inside a PyPI wheel; downloads additional stages from a **blockchain-based C2 channel** (delivery resolved on-chain to defeat static block-listing). Persistence via **PTH file injection** re-detonates at every Python startup. Attribution aligned to Lazarus APT / PolinRider based on payload characteristics and embedded indicators - continues the year-long pattern of Lazarus-tagged PyPI wallet-theft waves.

## Cluster G - PyPI `trongridet` TRX (Tron) private-key exfil

| Package | Version | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `trongridet` | `0.0.1` | GHSA-6q35-8j6x-jx75 | `d37e7917…5a3483` | `2025-04-tronix` |

Designed for Tron (TRX) private-key exfiltration. README lifted from a legitimate crypto library. Repeated PyPI uploads under variant names indicate an organised campaign against Tron users.

## Cluster H - PyPI PROBABLY_PENTEST setup.py IP+username exfil (4 packages)

| Package | Versions | GHSA | Source hash |
|---|---|---|---|
| `bigquery-agent-analytics-tracing` | `0.0.0, 0.0.1` | GHSA-3757-66f7-2vxg | `08fbff35…02ad99` |
| `0xfighter3` | `0.1` | GHSA-w8cx-q6rx-qfj2 | `5a97978…ff36f` |
| `syntaxerror-package-12345` | `0.1` | GHSA-pg4p-fr45-wfxc | `ede434c…171d9` |
| `rce-test` | `0.1` | GHSA-5j7w-88pp-6hpr | `c27b8e5…0fa2d` |

All follow the same shape: `setup.py` override runs at install, exfiltrates host IP and OS username to a bounty / pentest endpoint. OpenSSF PA classifies as `PROBABLY_PENTEST` / `GENERIC-standard-pypi-install-pentest`. `bigquery-agent-analytics-tracing` reads as a legitimate Google BigQuery integration and is the highest-risk of the four for accidental transitive resolution in a CI job.

## Cluster I - npm 2026-08-27 boilerplate CWE-506 (3 packages)

| Package | GHSA | Note |
|---|---|---|
| `node-pino` | GHSA-w294-7cjj-7mvg | **`pino` typosquat** (highest priority - `pino` is one of the most-downloaded loggers on npm) |
| `parallely` | GHSA-rmhx-v9xh-x4jv | Generic name |
| `bnotify-web-sdk` | GHSA-h2p9-v9rw-px6c | Browser-notify SDK lookalike |

## Cluster J - npm 2026-08-26 boilerplate / lookalike tail (11 packages)

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `svelte-vli-ui` | `>= 0` | GHSA-hxqf-cq68-wh37 | Extends 2026-08-25 Svelte/hydration lookalike burst |
| `hydration-vli-ui` (umbrella) | `>= 0` | GHSA-v229-xfmv-q98w | Umbrella; `1.0.0` is the ELF RAT above |
| `chai-plus` (umbrella) | `>= 0` | GHSA-2r27-f59g-4hcx | Umbrella; `6.2.3-6.2.5` are the typosquat above |
| `self-certificates` | `>= 0` | GHSA-rwg4-cx82-h5hq | Cert-tooling probe (paired with `self-sign`) |
| `self-sign` | `>= 0` | GHSA-9jvg-g3cg-g557 | Cert-tooling probe (paired with `self-certificates`) |
| `shai_hulululud` | `>= 0` | GHSA-c83w-r5p2-qhmj | Anti-AI-scanner protestware first catalogued 2026-06-16; GHSA is new, package is not - updated in the existing module rather than duplicated here |
| `dumb-binding-gyp-package` | `>= 0` | GHSA-p8h8-j624-2qhc | Native-module probe |
| `model-poc-suhail` | `>= 0` | GHSA-cpqg-wgv2-g29r | Researcher-named PoC |
| `zenntechinc-cli` | `1.6.4, 1.6.6` | GHSA-6wh9-pcqw-jp9j | Specific versions only (1.6.5 clean) - consistent with maintainer-account-takeover injection |
| `the_tax_free_cashier_is_at_9f` | `>= 0` | GHSA-4hc4-fpvc-7chp | Throwaway themed name |
| `grandfather_of_the_desert` | `>= 0` | GHSA-fjvc-xq44-gq59 | Throwaway themed name |
| `tset_racie` | `>= 0` | GHSA-7978-5fh2-74q2 | Throwaway themed name |

## Registry state

All 24 packages yanked from npm / PyPI during the 2026-08-26 / 2026-08-27 takedown windows. `shai_hulululud@1.0.48596` remained resolvable at last check (protestware, not yanked) - the new GHSA formalises it as malware for tooling that reads GHSA.

## Related tracked activity

- **Extended Vue/Svelte/Vite hydration lookalike burst** (Cluster A `hydration-vli-ui`, Cluster J `svelte-vli-ui`): continuation of the 2026-08-25 burst catalogued in [multi-2026-08-26-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep) Cluster F. The `vli-ui` sub-namespace is a new twist; watch for further `<framework>-<any3>-ui` publishes.
- **Lazarus / PolinRider PyPI wallet-theft** (Cluster F `pybitjs`): continues the pattern last seen in [`common-stack-generate-plugin` / PolinRider](https://dependencywatch.io/incident/npm-2026-05-21-common-stack-generate-plugin-polinrider) and multiple 2026 PyPI Lazarus waves.
- **`chai` typosquat surface** (Cluster E `chai-plus`): the `chai` assertion library is one of the highest-download testing packages on npm; verify `chai` resolves to the canonical package on every install.
- **Burp Collaborator abuse as throwaway supply-chain C2** (Cluster D `octopus-action`): the `*.oastify.com` domain family has legitimate bug-bounty use but no benign inbound-egress reason from production infrastructure; consider a blanket egress block for CI runners.
- **Dynamic-DNS second-stage C2** (Cluster E `taskforge-9xv` -> `coolblast.zapto.org`): `*.zapto.org` and similar dynamic-DNS providers (`ddns.net`, `hopto.org`, `no-ip.org`) show up repeatedly as stage-2 C2 - a blanket egress block from CI is a low-cost, high-value control.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector` (Cluster E credit), Lazarus / PolinRider attribution for Cluster F.

## Impact

- **Cluster A - npm `hydration-vli-ui@1.0.0` ELF-in-JS Linux RAT (2026-08-26, 1 package, 1 version)**: `hydration-vli-ui@1.0.0` (GHSA-8p96-6q9p-xvw5, source hash `44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480`, C2 `217.60.77.63`). The package contains a **Linux x86_64 ELF binary disguised as a JavaScript file**. On `require()` / `import`, the wrapper drops and executes the ELF, which opens a full-featured RAT: command shell over `/bin/sh` and `/bin/bash`; SOCKS / port-forwarding tunnelling; arbitrary file drop-and-execute; in-memory execution via `memfd_create` (leaves no on-disk artefact after load); persistence through **systemd user units**; exfiltration of SSH private keys, saved credentials, local database files, clipboard contents, and environment variables. No authentication is required to open the C2 - activation is on import alone. This is the highest-severity entry in the batch: any Linux host that installed `hydration-vli-ui@1.0.0` should be treated as root-compromised at the level of "attacker has an interactive shell right now"; systemd user-unit persistence survives casual reinstall of the developer tree
- **Cluster B - npm `commonjs-code-token` remote-eval postinstall C2 (2026-08-26, 1 package, 2 versions)**: `commonjs-code-token@1.0.0, 1.0.1` (GHSA-wq3w-3cqf-rjjj, source hash `c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad`, C2 `access-token-delta.vercel.app`). The postinstall hook runs `index.js`, which fetches JSON from `https://access-token-delta.vercel.app` and passes the returned `token` field directly to `eval()`. Whatever the operator chooses to serve at that endpoint is what runs on the installing host, with full node privileges. The README is copied from `node-cache-multithread` as cover story; the package has no legitimate functionality. Any host that ran `npm install commonjs-code-token` (either version) is a live remote-command channel until the operator lets go of the Vercel deployment. Rotate everything the install user had access to; the `eval()` return is unbounded so this is credential-theft, wallet-theft, or worm-propagation depending on what the operator served that hour
- **Cluster C - npm `spotify-url-resolvers` Telegram-C2 project-directory exfil (2026-08-26, 1 package)**: `spotify-url-resolvers` <= `3.4.2` (GHSA-mg73-v34h-w9f9, source hash `7318f0d70d44a05847fe3363f59c4e1465df1ecab43fc87757c324397e2b1cea`). On module load the package starts an **hourly loop** that archives the installer's project directory into a ZIP (excluding `node_modules` / `.git`, but **including `.env`**) and exfiltrates each archive to a Telegram bot (`8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM`, chat `7549282259`). The README carries Arabic-language instructions encouraging the reader to `require()` the module - a social hook targeting Arabic-speaking developers. Any project that landed this package has had **every source file plus every `.env` file** in the working tree hourly-uploaded to the operator; assume every secret in every `.env` file is compromised and rotate now. Block the Telegram bot token and chat ID at the egress proxy if you have one
- **Cluster D - npm `octopus-action` Burp Collaborator preinstall exfil (2026-08-26, 1 package)**: `octopus-action` <= `1.0.1` (GHSA-xp3r-4585-7gx2, source hash `6968c2a12f60b671ee163f42c9da14ed51d9b0b29486b4a7d1bf5014b4c637f2`, C2 `dfwvktnc563cparn1p88c8051w7ovej3.oastify.com`). The **preinstall lifecycle script** runs automatically during `npm install` and POSTs system information over HTTPS to a **Burp Collaborator** endpoint on `oastify.com`: hostname, OS username, home directory, DNS configuration, package metadata, plus **the full contents of `/etc/passwd` and `/etc/hosts`**. This is the classic bug-bounty / red-team reconnaissance package pattern; whether the operator is a bounty-hunter probing scoped programs or an actor using Collaborator as convenient throwaway infrastructure is unknowable from the artefact alone. Any CI runner that resolved this package leaked its `/etc/passwd` and internal `/etc/hosts` (which routinely contains internal hostnames not otherwise resolvable). Rotate CI runner secrets and audit `/etc/hosts` for anything internal-topology-revealing
- **Cluster E - npm `chai-plus` `taskforge-9xv` second-stage installer (2026-08-26, 1 package, 3 versions)**: `chai-plus@6.2.3, 6.2.4, 6.2.5` (GHSA-m5q5-4fx8-hh2m, source hash `b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9`; a companion GHSA-2r27-f59g-4hcx marks all versions boilerplate-compromised). On module import the bootstrap function `npm install --global taskforge-9xv@1.3.0` (silently) and then executes the installed package with hardcoded arguments pointing at `http://coolblast.zapto.org:8888` (unencrypted HTTP; dynamic DNS via `zapto.org`) with an embedded authentication token. Errors are silently swallowed. The name is a **`chai` assertion-library typosquat** targeting developers who mistype the ubiquitous test-framework install. Any host that landed `chai-plus` should assume `taskforge-9xv@1.3.0` was installed globally as a stage-2 backdoor; audit `npm ls -g` for it and remove
- **Cluster F - PyPI `pybitjs` Lazarus/PolinRider blockchain-C2 (2026-08-26, 1 package, 1 version)**: `pybitjs@0.1.0` (GHSA-wv93-5fvj-96j3, source hash `8cf3b72788a1ad482702768ea3b7f958793a0997cf77342578c31bc6dcfd23c8`, campaign `2026-08-pybitjs`). Ships obfuscated JavaScript-based malware inside a PyPI wheel; downloads additional stages from a **blockchain-based C2 channel** (delivery is resolved on-chain to defeat static block-listing). Persistence via **PTH file injection** ensures the payload re-detonates at every Python startup, not just install time. Attribution: aligned to Lazarus APT / PolinRider based on payload characteristics and embedded indicators - the same operator behind the earlier PyPI wallet-theft waves this year. High-confidence targeted infostealer
- **Cluster G - PyPI `trongridet` TRX (Tron) private-key exfil (2026-08-26, 1 package, 1 version)**: `trongridet@0.0.1` (GHSA-6q35-8j6x-jx75, source hash `d37e79174370b2dcd44b05ddb583e65d2e0b878033aa0702653294dc965a3483`, campaign `2025-04-tronix`). Designed for **cryptocurrency private-key exfiltration** targeting Tron (TRX) users. Repeated PyPI uploads under variant names, README lifted from a legitimate crypto library to blend in. Any host with a Tron wallet that ran `pip install trongridet` should be considered wallet-compromised; move funds off-chain from a clean device
- **Cluster H - PyPI PROBABLY_PENTEST setup.py IP+username exfil cluster (2026-08-26, 4 packages)**: `bigquery-agent-analytics-tracing@0.0.0, 0.0.1` (GHSA-3757-66f7-2vxg, hash `08fbff35384a45aedc39545dd2a174889a1c35f3e6c9d044c2c201905402ad99`), `0xfighter3@0.1` (GHSA-w8cx-q6rx-qfj2, hash `5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f`), `syntaxerror-package-12345@0.1` (GHSA-pg4p-fr45-wfxc, hash `ede434cf61641064a49939821778e511c3fcf8afab7e443582b8b103e13171d9`), `rce-test@0.1` (GHSA-5j7w-88pp-6hpr, hash `c27b8e593dc0298e09bb4a5fd6acc68dc03bf324bdc7267e87482fdd10b0fa2d`). All follow the same shape: `setup.py` override runs at install time, exfiltrates host IP and OS username. OpenSSF Package Analysis classifies as `PROBABLY_PENTEST` / `GENERIC-standard-pypi-install-pentest`. The `bigquery-agent-analytics-tracing` name is the highest-risk of the four - it reads as a legitimate Google BigQuery integration and an unattended CI job auto-installing on transitive resolve of a "bigquery" search would land it. The others (`0xfighter3`, `syntaxerror-package-12345`, `rce-test`) read as bug-bounty PoCs but the same payload channel could ship arbitrary command execution
- **Cluster I - npm 2026-08-27 boilerplate CWE-506 (3 packages)**: `node-pino` (GHSA-w294-7cjj-7mvg) - **`pino` logger typosquat**, `node-<popular>` prefix pattern targeting the ubiquitous `pino` structured logger, highest priority in this cluster; `parallely` (GHSA-rmhx-v9xh-x4jv) - generic name; `bnotify-web-sdk` (GHSA-h2p9-v9rw-px6c) - lookalike "browser notify SDK". All `>= 0`, all CWE-506 boilerplate ("considered fully compromised") with no per-package IOCs published
- **Cluster J - npm 2026-08-26 boilerplate/lookalike tail (11 packages)**: `svelte-vli-ui` (GHSA-hxqf-cq68-wh37) and `hydration-vli-ui >= 0` (GHSA-v229-xfmv-q98w) - continuations of the 2026-08-25 Vue/Svelte/Vite lookalike burst under the new `vli-ui` sub-namespace (the specific `hydration-vli-ui@1.0.0` version is the RAT above; `>= 0` boilerplate is the umbrella advisory); `chai-plus >= 0` (GHSA-2r27-f59g-4hcx) - umbrella advisory for the `chai` typosquat above; `self-certificates` (GHSA-rwg4-cx82-h5hq) and `self-sign` (GHSA-9jvg-g3cg-g557) - paired probes for self-signed-cert tooling; `shai_hulululud` (GHSA-c83w-r5p2-qhmj) - the anti-AI-scanner protestware first catalogued 2026-06-16 now has a formal GHSA (same package, no new version, updated in the existing `npm-2026-06-16-shai-hulululud-ai-scanner-protestware.ts` module); `dumb-binding-gyp-package` (GHSA-p8h8-j624-2qhc) - native-module probe; `model-poc-suhail` (GHSA-cpqg-wgv2-g29r) - researcher-named PoC; `zenntechinc-cli@1.6.4, 1.6.6` (GHSA-6wh9-pcqw-jp9j) - specific-version compromise of a `zenntechinc` CLI (odd version pattern - 1.6.4 and 1.6.6 but not 1.6.5, consistent with maintainer-account-takeover injecting into published-but-scattered versions); `the_tax_free_cashier_is_at_9f` (GHSA-4hc4-fpvc-7chp), `grandfather_of_the_desert` (GHSA-fjvc-xq44-gq59), `tset_racie` (GHSA-7978-5fh2-74q2) - throwaway themed names, no per-package IOCs

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for: `hydration-vli-ui`, `commonjs-code-token`, `spotify-url-resolvers`, `octopus-action`, `chai-plus`, `pybitjs`, `trongridet`, `bigquery-agent-analytics-tracing`, `0xfighter3`, `syntaxerror-package-12345`, `rce-test`, `node-pino`, `parallely`, `bnotify-web-sdk`, `svelte-vli-ui`, `self-certificates`, `self-sign`, `shai_hulululud`, `dumb-binding-gyp-package`, `model-poc-suhail`, `zenntechinc-cli`, `the_tax_free_cashier_is_at_9f`, `grandfather_of_the_desert`, `tset_racie`
2. **For Cluster A (`hydration-vli-ui@1.0.0` Linux RAT)**: any Linux host that installed this package should be treated as **root-compromised at the level of "attacker has an interactive shell right now"**. Kill the machine now if it is a shared host or CI runner. Hunt for systemd user units created in the exposure window (`systemctl --user list-unit-files --state=enabled` + `ls -la ~/.config/systemd/user/`). Search for the ELF hash `44daff58…7d0480` in EDR retrospective queries. Block C2 IP `217.60.77.63` at egress. Rotate every SSH key on the host and revoke the corresponding public keys from every server that authorized them; rotate every credential harvested from `~/.aws`, `~/.docker`, `~/.kube`, `~/.npmrc`, `~/.pypirc`, browser profiles. `memfd_create`-executed payloads leave no on-disk artefact - assume the malware ran even if disk scanning finds nothing
3. **For Cluster B (`commonjs-code-token` remote eval)**: uninstall from every project. Rotate every credential the install user (or the shared CI service account) had access to during the exposure window. Because the eval channel serves arbitrary content and can vary hour-to-hour, "the machine looked fine yesterday" is not a signal. Block `access-token-delta.vercel.app` at the egress proxy. Push source hash `c6ab469a…4883ad` to endpoint scanning
4. **For Cluster C (`spotify-url-resolvers` Telegram-C2)**: **every `.env` file** on every host that landed this package has been exfiltrated on the hourly loop. Rotate every secret in every `.env` file in every affected project - assume API keys, DB passwords, cloud credentials, and OAuth tokens are all compromised. Block Telegram bot token `8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM` (and if you can, the chat ID `7549282259`) at the egress proxy. Also block generic outbound to `api.telegram.org` from CI runners unless required
5. **For Cluster D (`octopus-action` Burp Collaborator exfil)**: rotate CI runner secrets on any runner that resolved this package. Audit `/etc/hosts` on the affected host for any internal-topology hostnames leaked to the operator. Block `*.oastify.com` at egress (Burp Collaborator is a legitimate bug-bounty tool but has no benign inbound-egress reason from production infrastructure)
6. **For Cluster E (`chai-plus` typosquat)**: **audit `npm ls -g` for `taskforge-9xv@1.3.0` and remove it** - the second-stage payload globally installs itself and survives uninstalling the initial `chai-plus` typosquat. Block `coolblast.zapto.org` (and pattern `*.zapto.org` if practical - dynamic-DNS providers have almost no benign use from production infrastructure)
7. **For Cluster F (`pybitjs` Lazarus/PolinRider)**: any Python interpreter on a host that ran `pip install pybitjs==0.1.0` re-detonates the payload at **every Python startup** via PTH injection. `pip uninstall` is not sufficient - hunt for injected `.pth` files under `site-packages/` on every affected environment and remove them by hand. Because C2 delivery is on-chain, network-based block-listing of a single domain will not work; the reliable control is to nuke the affected virtual environment and rebuild from a locked, hash-verified requirements file
8. **For Cluster G (`trongridet` TRX exfil)**: any Tron wallet on a host that installed `trongridet==0.0.1` should be considered private-key-compromised. Move Tron funds off from a clean host now
9. **For Cluster H (PyPI PROBABLY_PENTEST)**: uninstall from every environment. `bigquery-agent-analytics-tracing` is the highest-risk name - any org running BigQuery integrations should audit CI pip resolves for accidental transitive pulls. Even the "harmless" pentest payload channel could ship anything the operator chooses; treat as low-signal but not zero
10. **For Cluster I (2026-08-27 npm boilerplate)**: `node-pino` is the highest-risk - developers who mistype `pino` (the ubiquitous structured logger with ~30M weekly downloads) or search for a "node-pino" wrapper will land the malicious variant. Verify every `pino` install resolves to `pino` on the `@pino` scope
11. For all `pip install` runs in CI, prefer `--only-binary=:all:` and pin to source hashes - Clusters F, G, H all execute at install time via setup.py or wheel side-effects
12. For all `npm install` runs in CI, run with `--ignore-scripts` where possible - Clusters B, C, D, E all execute via install lifecycle scripts or on `require()`. `--ignore-scripts` alone does NOT stop payloads that fire on `require()` (Clusters A, C, E) - a separate policy is needed to keep the package out of the tree in the first place
13. Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-8p96-6q9p-xvw5 - hydration-vli-ui@1.0.0 (npm Linux x86_64 ELF-in-JS RAT with systemd persistence)](https://github.com/advisories/GHSA-8p96-6q9p-xvw5) - GitHub
- [GHSA-wq3w-3cqf-rjjj - commonjs-code-token (npm postinstall remote-eval C2 via Vercel)](https://github.com/advisories/GHSA-wq3w-3cqf-rjjj) - GitHub
- [GHSA-mg73-v34h-w9f9 - spotify-url-resolvers (npm hourly project-dir ZIP exfil to Telegram bot)](https://github.com/advisories/GHSA-mg73-v34h-w9f9) - GitHub
- [GHSA-xp3r-4585-7gx2 - octopus-action (npm preinstall /etc/passwd + /etc/hosts exfil to Burp Collaborator)](https://github.com/advisories/GHSA-xp3r-4585-7gx2) - GitHub
- [GHSA-m5q5-4fx8-hh2m - chai-plus@6.2.3-6.2.5 (npm chai typosquat with taskforge-9xv second-stage installer)](https://github.com/advisories/GHSA-m5q5-4fx8-hh2m) - GitHub
- [GHSA-2r27-f59g-4hcx - chai-plus umbrella (npm chai typosquat, all versions)](https://github.com/advisories/GHSA-2r27-f59g-4hcx) - GitHub
- [GHSA-wv93-5fvj-96j3 - pybitjs (PyPI Lazarus/PolinRider PTH-injection blockchain-C2)](https://github.com/advisories/GHSA-wv93-5fvj-96j3) - GitHub
- [GHSA-6q35-8j6x-jx75 - trongridet (PyPI Tron TRX private-key exfil)](https://github.com/advisories/GHSA-6q35-8j6x-jx75) - GitHub
- [GHSA-3757-66f7-2vxg - bigquery-agent-analytics-tracing (PyPI PROBABLY_PENTEST setup.py exfil)](https://github.com/advisories/GHSA-3757-66f7-2vxg) - GitHub
- [GHSA-w8cx-q6rx-qfj2 - 0xfighter3 (PyPI PROBABLY_PENTEST setup.py exfil)](https://github.com/advisories/GHSA-w8cx-q6rx-qfj2) - GitHub
- [GHSA-pg4p-fr45-wfxc - syntaxerror-package-12345 (PyPI PROBABLY_PENTEST setup.py exfil)](https://github.com/advisories/GHSA-pg4p-fr45-wfxc) - GitHub
- [GHSA-5j7w-88pp-6hpr - rce-test (PyPI PROBABLY_PENTEST setup.py exfil)](https://github.com/advisories/GHSA-5j7w-88pp-6hpr) - GitHub
- [GHSA-w294-7cjj-7mvg - node-pino (npm pino logger typosquat, CWE-506)](https://github.com/advisories/GHSA-w294-7cjj-7mvg) - GitHub
- [GHSA-rmhx-v9xh-x4jv - parallely (npm CWE-506 boilerplate)](https://github.com/advisories/GHSA-rmhx-v9xh-x4jv) - GitHub
- [GHSA-h2p9-v9rw-px6c - bnotify-web-sdk (npm CWE-506 boilerplate)](https://github.com/advisories/GHSA-h2p9-v9rw-px6c) - GitHub
- [GHSA-hxqf-cq68-wh37 - svelte-vli-ui (npm Svelte lookalike extension)](https://github.com/advisories/GHSA-hxqf-cq68-wh37) - GitHub
- [GHSA-v229-xfmv-q98w - hydration-vli-ui umbrella (npm >= 0)](https://github.com/advisories/GHSA-v229-xfmv-q98w) - GitHub
- [GHSA-rwg4-cx82-h5hq - self-certificates (npm cert-tooling probe)](https://github.com/advisories/GHSA-rwg4-cx82-h5hq) - GitHub
- [GHSA-9jvg-g3cg-g557 - self-sign (npm cert-tooling probe)](https://github.com/advisories/GHSA-9jvg-g3cg-g557) - GitHub
- [GHSA-c83w-r5p2-qhmj - shai_hulululud (npm anti-AI-scanner protestware; formalises the June disclosure)](https://github.com/advisories/GHSA-c83w-r5p2-qhmj) - GitHub
- [GHSA-p8h8-j624-2qhc - dumb-binding-gyp-package (npm native-module probe)](https://github.com/advisories/GHSA-p8h8-j624-2qhc) - GitHub
- [GHSA-cpqg-wgv2-g29r - model-poc-suhail (npm researcher-named PoC)](https://github.com/advisories/GHSA-cpqg-wgv2-g29r) - GitHub
- [GHSA-6wh9-pcqw-jp9j - zenntechinc-cli@1.6.4, 1.6.6 (npm specific-version compromise)](https://github.com/advisories/GHSA-6wh9-pcqw-jp9j) - GitHub
- [GHSA-4hc4-fpvc-7chp - the_tax_free_cashier_is_at_9f (npm throwaway CWE-506)](https://github.com/advisories/GHSA-4hc4-fpvc-7chp) - GitHub
- [GHSA-fjvc-xq44-gq59 - grandfather_of_the_desert (npm throwaway CWE-506)](https://github.com/advisories/GHSA-fjvc-xq44-gq59) - GitHub
- [GHSA-7978-5fh2-74q2 - tset_racie (npm throwaway CWE-506)](https://github.com/advisories/GHSA-7978-5fh2-74q2) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).