GitHub Advisory malware sweep, 28 August 2026

The full picture

36 packages 68 versions

• npm@fleetbo/svro0.0.20.0.30.0.40.0.50.0.60.0.70.0.90.0.100.0.110.0.120.0.130.0.140.0.150.0.160.0.170.0.190.0.200.0.210.0.220.0.230.0.240.0.260.0.270.0.290.0.300.0.310.0.320.0.330.0.340.0.350.0.370.0.380.0.390.0.400.0.42→
• npm@hd-team/app-dnpkg-beta→
• npm@hd-team/app-dnpkg-eight→
• npm@hd-team/app-dnpkg-prod→
• npm@hd-team/app-dnpkg-ten→
• npm@hd-team/app-dnpkg-test→
• npm@hd-team/app-dnpkg-three→
• npm@hd-team/app-impkg-prod→
• npm@hd-team/app-impkg-test→
• npm@postman-cse/okta-aio-darwin-arm64→
• npm@znan/wabot→
• npmcharclass→
• PyPIdecoris0.3.00.3.3→
• npmdeepjoin→
• PyPIdiscordnv0.8.0→
• PyPIekx-report-utils0.1.00.2.00.3.00.4.0→
• PyPIflyteplugins-agento11y2.6.10→
• PyPIflyteplugins-echo2.6.10→
• PyPIflyteplugins-nsight2.6.10→
• PyPIflyteplugins-redis2.6.10→
• npmhydration-ui-dlx→
• npminspectstack→
• PyPImathkitlite0.1.0→
• npmmodule-relpath→
• npmmorglog→
• npmpushgitquickx1.0.01.0.41.0.51.0.61.0.71.0.81.0.91.0.101.0.111.0.121.0.131.0.141.0.151.0.161.0.17→
• PyPIsap-quarterly-report1.0.0→
• npmsigcheck→
• npmstackpaths→
• npmsvelte-ui-dlx→
• npmtailwindcss-3d-animate→
• npmtailwindcss-form-styles→
• npmveloq→
• PyPIyaml-report-formatter0.1.00.2.00.3.0→
• PyPIyamlformat-tools0.1.0→
• PyPIyamlformatter-utils1.0.0→

What it does if you installed it

• *Cluster A - PyPI `flyteplugins- dependency-confusion cluster (2026-08-28, 4 packages, all v2.6.10)**: flyteplugins-redis@2.6.10 (GHSA-23fv-6cgr-766g, source hash 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03), flyteplugins-agento11y@2.6.10 (GHSA-8cpp-43j8-xg7c, hash 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a), flyteplugins-nsight@2.6.10 (GHSA-33m6-gx9h-9qv5, hash 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129, MAL-2026-14583), flyteplugins-echo@2.6.10 (GHSA-gcjf-mv7f-ffmf, hash e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c). All four names pattern-match Flyte / Union.ai internal package naming (real flytekitplugins- and flyteplugins- packages exist on PyPI; canonical publisher is flyteorg). All four setup.py overrides exfiltrate host IP and OS username. **The identical 2.6.10 version pin across all four is the tell**: this is a dependency-confusion probe hoping Flyte / Union.ai internal CI would resolve 2.6.10` from PyPI instead of the internal index (2.6.10 likely mirrors a real internal Flyte version). OpenSSF classifies as PROBABLY_PENTEST but the target-selection is not accidental - a real hit would land arbitrary command execution on Flyte / Union.ai CI
• Cluster B - PyPI discordnv@0.8.0 Discord+Roblox DPAPI infostealer (2026-08-27, 1 package, 1 version): discordnv@0.8.0 (GHSA-89r4-hq67-cfgq, hashes 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 (Amazon Inspector) and d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646 (kam193)). On import steals Discord authentication tokens across every installed Discord client, reads and DPAPI-decrypts Roblox robloxcookies.dat from multiple browsers, exfiltrates to a Discord webhook (discord.com/api/webhooks/1528403989983662194/...) and a Google Apps Script endpoint (script.google.com/macros/s/AKfycbwa.../exec). Persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry entry named discordnv. Any Windows host that ran pip install discordnv==0.8.0 should be considered credential-compromised for Discord and Roblox at minimum; the DPAPI reach also means anything protected by user-DPAPI (browser saved passwords, some VPN clients) is potentially reachable
• Cluster C - PyPI decoris@0.3.0, 0.3.3 Roblox cookie exfil (2026-08-27, 1 package, 2 versions): decoris@0.3.0, 0.3.3 (GHSA-v4c9-8j66-3xg2, hash 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973, campaign 2026-06-spaysrbdata). Roblox cookie infostealer targeting the same population as discordnv. Campaign identifier links back to a June 2026 spaysrbdata cluster - operator has been active for months. Move Roblox account cookies / revoke sessions from a clean host
• *Cluster D - PyPI sap-quarterly-report + ekx-report-utils + `yaml DNS exfil family (2026-08-27 / 2026-08-28, 5 packages)**: sap-quarterly-report@1.0.0 (GHSA-3g4v-hc5w-c37x, hash 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec), ekx-report-utils@0.1.0, 0.2.0, 0.3.0, 0.4.0 (GHSA-77v5-hfrm-j4h4, hash a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6), yaml-report-formatter@0.1.0, 0.2.0, 0.3.0 (GHSA-3q3w-rmgq-cq8x, hash 207190bd409999efcab9a56f8e536b6caf9c6a5ab92a134b77421f4bf1650f01, MAL-2026 series), yamlformat-tools@0.1.0 (GHSA-fgh2-58j8-r2cq, hash 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734) and yamlformatter-utils@1.0.0 (GHSA-rccj-4982-7jfw, hash ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2). All five import-time collect sensitive host info and exfiltrate via DNS queries - egress-firewall-bypass by encoding data into DNS subdomain labels. Shared campaign identifier 2026-08-ekx-report-utils groups them (the three yaml names published 2026-08-28 confirm the operator did not stop at the 08-27 batch and is iterating on report/formatter-flavoured lures). The sap-quarterly-report name is a targeted lure at SAP finance / accounting shops; ekx-report-utils and the yaml-report-formatter / yamlformat-tools/utils` names read like internal reporting helpers a Python data / BI shop would pull without a second look. DNS-based exfil is the important detail - a proxy-only egress policy does not block it if internal DNS resolvers forward externally. Discovery credit: kam193 (bad-packages.kam193.eu) plus GitHub Advisory Database / OpenSSF Package Analysis
• Cluster E - PyPI mathkitlite@0.1.0 PROBABLY_PENTEST (2026-08-27, 1 package, 1 version): mathkitlite@0.1.0 (GHSA-j3j9-38mp-8cf7, hash c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845, MAL-2026-14552). setup.py override exfiltrates host IP and OS username at install time - the same generic PROBABLY_PENTEST shape as recent kam193 discoveries. Low signal individually but part of the persistent PyPI pentest-probe background
• Cluster F - npm @vapi-ai/server-sdk formal GHSA backfill (2026-08-27, adds 3 more versions to 2026-06-03 Phantom Gyp wave): GHSA-mjhg-2cvf-w2p4 formalises the Phantom Gyp / Miasma compromise of @vapi-ai/server-sdk and adds versions 0.11.2, 1.2.1, 1.2.2 to the previously-tracked 0.11.1 - the existing 2026-06-03 record has been updated in place rather than duplicated here. Anyone still resolving those exact version pins from an internal mirror after 2026-06-04 remained exposed until the GHSA landed on 2026-08-27
• Cluster G - npm @postman-cse/okta-aio-darwin-arm64@0.11.6- internal-namespace probe (2026-08-28, 1 package): @postman-cse/okta-aio-darwin-arm64 <= 0.11.6 (GHSA-2qc4-r3x2-xh47). Reads as a Postman internal Customer Success/Solution Engineering (cse) Okta All-In-One (aio) darwin-arm64 platform-specific binary sub-package - the exact namespace shape a Postman internal CI job could pull-through if the private mirror briefly failed over to the public registry. Whether the @postman-cse org is genuinely Postman-controlled or a squat of the naming pattern is not disclosed in the GHSA; treat any resolution of this scope in a build log as a private-registry misconfiguration to investigate. Postman-adjacent orgs should verify their .npmrc scope-registry pins
• *Cluster H - npm `@hd-team/ operator cluster (2026-08-27, 8 packages)**: @hd-team/app-impkg-prod (GHSA-g7cq-7vcf-rp48), @hd-team/app-dnpkg-beta (GHSA-6p53-v557-745c), @hd-team/app-dnpkg-three (GHSA-qwcv-3958-fhq5), @hd-team/app-dnpkg-prod (GHSA-35w7-82wv-vwxj), @hd-team/app-impkg-test (GHSA-hxxw-mprp-h9w7), @hd-team/app-dnpkg-ten (GHSA-q7mf-7f69-7qpr), @hd-team/app-dnpkg-test (GHSA-6fm3-xp27-2556), @hd-team/app-dnpkg-eight (GHSA-97qc-463w-p2jr). Eight coordinated advisories at one publisher account within one publish window - the app-impkg- / app-dnpkg- naming pattern is throwaway boilerplate rather than a typosquat of any real package. CWE-506 boilerplate advisories only; the operational value is knowing the @hd-team` scope is entirely poisoned so any lockfile hit under that scope should be uninstalled, not selectively pinned
• Cluster I - npm hydration/svelte -ui-dlx extension (2026-08-27, 2 packages): hydration-ui-dlx (GHSA-j5x7-qc6j-xwg4) and svelte-ui-dlx (GHSA-7qq8-vjh5-hpgw). Extends the multi-week hydration-*-ui / svelte-*-ui lookalike campaign (see multi-2026-08-25, multi-2026-08-26, multi-2026-08-27 sweeps) with a new -dlx suffix mirroring npm dlx / pnpm dlx / bunx terminology. CWE-506 boilerplate; no per-package IOCs. Watch for further <framework>-*-dlx publishes across the same campaign
• Cluster J - npm tailwindcss-3d-animate + tailwindcss-form-styles typosquats (2026-08-27, 2 packages): tailwindcss-3d-animate <= 1.1.0 (GHSA-683p-54mf-9297) and tailwindcss-form-styles <= 0.5.15 (GHSA-8wj9-gw6r-6vqh). tailwindcss-* prefix leverages the massive Tailwind CSS plugin surface; developers searching for a 3D animate plugin or form-styling plugin will find these ahead of legitimate options. Boilerplate CWE-506 with no per-package IOCs; treat as tailwindcss-* prefix hygiene reminder
• Cluster K - npm high-version-count boilerplate takeovers (2026-08-28, 2 packages): @fleetbo/svro@0.0.2-0.0.42 (GHSA-4hrx-gqq5-q956, ~35 versions) and @znan/wabot@0.0.5-0.2.2-beta.3 (GHSA-2jxx-8fv2-h8mj, 80+ versions). The version-count pattern (many published versions over months, all now flagged) is the tell of a maintainer-account takeover or a maintainer publishing malware from the outset and only now getting caught. Any project holding either package in a lockfile should treat every historical install as compromised, not just the most recent version
• Cluster L - npm pushgitquickx scattered-version takeover (2026-08-27, 1 package): pushgitquickx@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17 (GHSA-wx29-h78g-ww4f). The unusual gap (1.0.0 flagged, 1.0.1-1.0.3 clean, then 1.0.4-1.0.17 all flagged) is consistent with a maintainer-account takeover mid-release-train: an attacker got the publish token and shipped every subsequent patch until the account was locked. git-themed name (push-git-quick-x) suggests targeting developers looking for git-related tooling
• Cluster M - npm 2026-08-27 boilerplate CWE-506 tail (8 packages): stackpaths (GHSA-6hcw-m358-fq4q), inspectstack (GHSA-xjx7-pff2-34gp), charclass (GHSA-ccgj-rp72-9hvj), deepjoin (GHSA-37cw-jw3f-qf4v), module-relpath (GHSA-pmg4-2q5x-v3x5), sigcheck (GHSA-qm8v-w5qj-32jq), morglog (GHSA-v899-gp96-p5rv), veloq (GHSA-gccc-9phc-w64p). All >= 0, all CWE-506 boilerplate with no per-package IOCs. The mix of utility-sounding names (stackpaths, inspectstack, module-relpath, sigcheck) suggests scripted name-generation targeting developer search terms rather than specific typosquats

Clean-up steps

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: flyteplugins-redis, flyteplugins-agento11y, flyteplugins-nsight, flyteplugins-echo, discordnv, decoris, sap-quarterly-report, ekx-report-utils, yaml-report-formatter, yamlformat-tools, yamlformatter-utils, mathkitlite, @postman-cse/okta-aio-darwin-arm64, @hd-team/app-impkg-prod, @hd-team/app-dnpkg-beta, @hd-team/app-dnpkg-three, @hd-team/app-dnpkg-prod, @hd-team/app-impkg-test, @hd-team/app-dnpkg-ten, @hd-team/app-dnpkg-test, @hd-team/app-dnpkg-eight, hydration-ui-dlx, svelte-ui-dlx, tailwindcss-3d-animate, tailwindcss-form-styles, @fleetbo/svro, @znan/wabot, pushgitquickx, stackpaths, inspectstack, charclass, deepjoin, module-relpath, sigcheck, morglog, veloq
2. 2*For Cluster A (`flyteplugins- dependency-confusion probe)**: any organisation that runs Flyte / Union.ai internally MUST audit their pip / uv resolver configuration. Verify flytekitplugins- and flyteplugins- resolve exclusively to the canonical flyteorg publisher on the internal index. Pin --index-url (not --extra-index-url) to the internal mirror for CI runs of Flyte-adjacent code, so pip cannot silently fall through to PyPI. pip install --dry-run` a Flyte requirements set against a scratch env pointing only at PyPI to see whether the confused version resolves - if 2.6.10 comes back for any of the four flagged names, the attack shape is confirmed against your naming set
3. 3For Cluster B (discordnv Discord+Roblox DPAPI stealer): any Windows user who ran pip install discordnv==0.8.0 should reset Discord (log out all sessions, rotate token by password change), revoke Roblox sessions, and remove the persistence entry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\discordnv. Because the payload DPAPI-decrypts under the user profile, browser saved passwords for that user are also at risk - a browser password rotation from a clean host is a reasonable defensive move. Block the Discord webhook URL and the Google Apps Script endpoint at egress if you have a proxy
4. 4For Cluster C (decoris Roblox cookie exfil): revoke Roblox sessions from a clean host, uninstall the package, and hunt for prior versions of the same operator's campaign identifier 2026-06-spaysrbdata in historical pip install logs
5. 5*For Cluster D (sap-quarterly-report + ekx-report-utils + `yaml DNS exfil family)**: SAP finance / reporting and Python BI shops should verify these did not slip into any BI / finance-team pip install workflow. **DNS-based exfil bypasses HTTP-only egress proxies**: if your egress policy is proxy-only, verify your internal DNS resolvers do not forward externally-resolvable domains for pip-installer-user contexts; or add a DNS-egress-block for these campaign domains once IOCs are published. Because the operator is iterating on report/format/formatter/utils themes across multiple publish windows, extend the block-list beyond the exact names to any -report- / format-utils / yamlformat` install requested by an environment that should never touch these
6. 6For Cluster E (mathkitlite PROBABLY_PENTEST): uninstall from every environment. pip install --only-binary=:all: in CI helps against setup.py payloads that only trigger from sdist installs
7. 7For Cluster G (@postman-cse/okta-aio-darwin-arm64): any Postman-adjacent org should audit .npmrc for a scope-registry pin (@postman-cse:registry=https://...) and verify that scope is not resolvable from the public registry - the okta-aio-darwin-arm64 naming is exactly what a platform-specific internal binary package would look like, and a build box briefly failing over to the public registry would land the malicious version
8. 8*For Cluster H (`@hd-team/)**: treat the entire @hd-team` scope as poisoned. If any lockfile pins a package under this scope, uninstall the whole scope rather than trying to identify which subset is malicious - all 8 flagged siblings are boilerplate CWE-506 with no per-package IOCs, and the operator can publish more under the same account until the account is locked
9. 9For Clusters I, J, K, L, M: uninstall on hit and rebuild lockfiles. For high-version-count Cluster K takeovers, treat every historical install of @fleetbo/svro or @znan/wabot as compromised, not just the most recent version
10. 10For all pip install runs in CI, prefer --only-binary=:all: and pin to source hashes - Clusters A, B, C, D, E all execute at install time via setup.py or wheel side-effects. For flyteplugins-* shops, also lock the resolver to a single trusted index
11. 11For all npm install runs in CI, run with --ignore-scripts where possible - though the @hd-team and hydration-* clusters have no published IOCs, so scope-blocking at the private mirror is a stronger control
12. 12Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

Sources

• GHSA-23fv-6cgr-766g - flyteplugins-redis@2.6.10 (PyPI dependency-confusion setup.py exfil)github.comGitHub
• GHSA-8cpp-43j8-xg7c - flyteplugins-agento11y@2.6.10 (PyPI dependency-confusion setup.py exfil)github.comGitHub
• GHSA-33m6-gx9h-9qv5 - flyteplugins-nsight@2.6.10 (PyPI dependency-confusion setup.py exfil)github.comGitHub
• GHSA-gcjf-mv7f-ffmf - flyteplugins-echo@2.6.10 (PyPI dependency-confusion setup.py exfil)github.comGitHub
• GHSA-89r4-hq67-cfgq - discordnv@0.8.0 (PyPI Discord token + Roblox cookie DPAPI infostealer)github.comGitHub
• GHSA-v4c9-8j66-3xg2 - decoris@0.3.0, 0.3.3 (PyPI Roblox cookie exfil, campaign 2026-06-spaysrbdata)github.comGitHub
• GHSA-3g4v-hc5w-c37x - sap-quarterly-report@1.0.0 (PyPI DNS exfil, campaign 2026-08-ekx-report-utils)github.comGitHub
• GHSA-77v5-hfrm-j4h4 - ekx-report-utils (PyPI DNS exfil, campaign 2026-08-ekx-report-utils)github.comGitHub
• GHSA-3q3w-rmgq-cq8x - yaml-report-formatter (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)github.comGitHub
• GHSA-fgh2-58j8-r2cq - yamlformat-tools (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)github.comGitHub
• GHSA-rccj-4982-7jfw - yamlformatter-utils (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)github.comGitHub
• GHSA-j3j9-38mp-8cf7 - mathkitlite@0.1.0 (PyPI PROBABLY_PENTEST setup.py exfil)github.comGitHub
• GHSA-mjhg-2cvf-w2p4 - @vapi-ai/server-sdk formal advisory (npm; backfills Phantom Gyp 0.11.1, 0.11.2, 1.2.1, 1.2.2)github.comGitHub
• GHSA-2qc4-r3x2-xh47 - @postman-cse/okta-aio-darwin-arm64 (npm internal-namespace probe)github.comGitHub
• GHSA-g7cq-7vcf-rp48 - @hd-team/app-impkg-prod (npm CWE-506)github.comGitHub
• GHSA-6p53-v557-745c - @hd-team/app-dnpkg-beta (npm CWE-506)github.comGitHub
• GHSA-qwcv-3958-fhq5 - @hd-team/app-dnpkg-three (npm CWE-506)github.comGitHub
• GHSA-35w7-82wv-vwxj - @hd-team/app-dnpkg-prod (npm CWE-506)github.comGitHub
• GHSA-hxxw-mprp-h9w7 - @hd-team/app-impkg-test (npm CWE-506)github.comGitHub
• GHSA-q7mf-7f69-7qpr - @hd-team/app-dnpkg-ten (npm CWE-506)github.comGitHub
• GHSA-6fm3-xp27-2556 - @hd-team/app-dnpkg-test (npm CWE-506)github.comGitHub
• GHSA-97qc-463w-p2jr - @hd-team/app-dnpkg-eight (npm CWE-506)github.comGitHub
• GHSA-j5x7-qc6j-xwg4 - hydration-ui-dlx (npm hydration-lookalike continuation)github.comGitHub
• GHSA-7qq8-vjh5-hpgw - svelte-ui-dlx (npm hydration-lookalike continuation)github.comGitHub
• GHSA-683p-54mf-9297 - tailwindcss-3d-animate (npm tailwindcss-* typosquat)github.comGitHub
• GHSA-8wj9-gw6r-6vqh - tailwindcss-form-styles (npm tailwindcss-* typosquat)github.comGitHub
• GHSA-4hrx-gqq5-q956 - @fleetbo/svro (npm ~35-version maintainer takeover)github.comGitHub
• GHSA-2jxx-8fv2-h8mj - @znan/wabot (npm 80+-version maintainer takeover)github.comGitHub
• GHSA-wx29-h78g-ww4f - pushgitquickx (npm scattered-version takeover)github.comGitHub
• GHSA-6hcw-m358-fq4q - stackpaths (npm CWE-506)github.comGitHub
• GHSA-xjx7-pff2-34gp - inspectstack (npm CWE-506)github.comGitHub
• GHSA-ccgj-rp72-9hvj - charclass (npm CWE-506)github.comGitHub
• GHSA-37cw-jw3f-qf4v - deepjoin (npm CWE-506)github.comGitHub
• GHSA-pmg4-2q5x-v3x5 - module-relpath (npm CWE-506)github.comGitHub
• GHSA-qm8v-w5qj-32jq - sigcheck (npm CWE-506)github.comGitHub
• GHSA-v899-gp96-p5rv - morglog (npm CWE-506)github.comGitHub
• GHSA-gccc-9phc-w64p - veloq (npm CWE-506)github.comGitHub
• GitHub Advisory Database - recent npm malware advisoriesgithub.comGitHub
• GitHub Advisory Database - recent pip malware advisoriesgithub.comGitHub
• OpenSSF malicious-packages repositorygithub.comOpenSSF