DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 28 Aug 2026Updated 29 Aug 202636 packages · 68 versions

GitHub Advisory malware sweep - 2026-08-28 batch (PyPI `flyteplugins-*` dependency-confusion cluster (4) + PyPI `discordnv` Discord/Roblox DPAPI infostealer + PyPI `decoris` Roblox cookie stealer + PyPI `sap-quarterly-report` + `ekx-report-utils` DNS-exfil pair + PyPI `mathkitlite` PROBABLY_PENTEST + npm `@postman-cse/okta-aio-darwin-arm64` internal-namespace dependency-confusion probe + npm `@hd-team/*` cluster (8) + npm `hydration-ui-dlx` / `svelte-ui-dlx` hydration-lookalike continuation + npm `tailwindcss-*` typosquats (2) + npm long-tail CWE-506 boilerplate)

Summary

31 new GHSA malware advisories in the 24h window ending 2026-08-28. Highlights: 4 flyteplugins-* PyPI packages all published at the identical exact version 2.6.10 - a dependency-confusion probe against Union.ai / Flyte internal package namespaces; PyPI discordnv@0.8.0 steals Discord tokens plus DPAPI-decrypts Roblox cookies with full Discord-webhook + Google-Apps-Script + registry-persistence IOCs; PyPI sap-quarterly-report + ekx-report-utils share a DNS-exfil campaign; npm @postman-cse/okta-aio-darwin-arm64 reads as a Postman internal okta-aio binary namespace hit.

dependency-confusioninfostealercredential-thefttyposquataccount-takeoverdns-exfiltrationobfuscation
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector · kam193
Also known as
2026-08-28 GHSA sweep · 2026-08-flyteplugins dependency-confusion · 2026-08-discordnv Discord Roblox stealer · 2026-06-spaysrbdata · 2026-08-ekx-report-utils · @postman-cse okta-aio internal-namespace probe
Ecosystems
npmPyPI
Packages tracked
36

What happened

The 24-hour window ending 2026-08-28 06:00 UTC published 31 new GHSA malware advisories across npm and PyPI. (Updated 2026-08-29: three additional PyPI packages - yaml-report-formatter, yamlformat-tools, yamlformatter-utils - published later on 2026-08-28 have been added to Cluster D under the shared 2026-08-ekx-report-utils campaign identifier.) The window is dominated by two organised campaigns - a PyPI flyteplugins-* dependency-confusion probe (4 identical-version publishes against the Flyte / Union.ai internal package namespace) and a Windows-targeted Discord+Roblox infostealer with full IOCs - plus the routine boilerplate CWE-506 tail.

Cluster A - PyPI flyteplugins-* dependency-confusion cluster (Union.ai / Flyte target)

| Package | Version | GHSA | Source hash | |---|---|---|---| | flyteplugins-redis | 2.6.10 | GHSA-23fv-6cgr-766g | 785b972d…64c03 | | flyteplugins-agento11y | 2.6.10 | GHSA-8cpp-43j8-xg7c | 46ad72ab…66c09a | | flyteplugins-nsight | 2.6.10 | GHSA-33m6-gx9h-9qv5 | 46b08f15…f2f129 | | flyteplugins-echo | 2.6.10 | GHSA-gcjf-mv7f-ffmf | e40fe85c…78b85c |

All four setup.py overrides exfiltrate host IP and OS username. The identical 2.6.10 version pin across all four is the tell: this is a dependency-confusion probe against the Flyte / Union.ai internal package namespace. Canonical Flyte plugin packages are published as flytekitplugins-* and flyteplugins-* under the flyteorg publisher; the target-selection here mirrors that pattern exactly (a redis connector, an agent observability helper, an nsight NVIDIA profiler integration, an echo test plugin - all names a real internal Flyte plugin catalogue would carry). OpenSSF classifies as PROBABLY_PENTEST but if any Flyte-shop CI is misconfigured to fall through to PyPI on internal-index failure, the setup.py exfil is a real hit and a follow-on payload could ship arbitrary code.

Cluster B - PyPI discordnv@0.8.0 Discord+Roblox DPAPI infostealer

| Package | Version | GHSA | Amazon Inspector hash | kam193 hash | |---|---|---|---|---| | discordnv | 0.8.0 | GHSA-89r4-hq67-cfgq | 2f791396…3ba48 | d28ded2c…92f3646 |

IOCs: Discord webhook discord.com/api/webhooks/1528403989983662194/...; Google Apps Script script.google.com/macros/s/AKfycbwa.../exec; Windows registry persistence HKCU\Software\Microsoft\Windows\CurrentVersion\Run\discordnv.

On import, steals Discord authentication tokens across every installed Discord client and DPAPI-decrypts Roblox robloxcookies.dat from multiple browsers. Because the payload DPAPI-decrypts under the user profile, browser saved passwords for that user are also at risk. Windows-targeted.

Cluster C - PyPI decoris@0.3.0, 0.3.3 Roblox cookie exfil

| Package | Versions | GHSA | Source hash | Campaign | |---|---|---|---|---| | decoris | 0.3.0, 0.3.3 | GHSA-v4c9-8j66-3xg2 | 1ce74b34…d9973 | 2026-06-spaysrbdata |

Roblox cookie infostealer, same population as discordnv. Campaign identifier links back to a June 2026 spaysrbdata cluster (kam193 discovery).

Cluster D - PyPI sap-quarterly-report + ekx-report-utils + yaml* DNS exfil family (shared campaign)

| Package | Versions | GHSA | Source hash | |---|---|---|---| | sap-quarterly-report | 1.0.0 | GHSA-3g4v-hc5w-c37x | 2235bdf8…567b37ec | | ekx-report-utils | 0.1.0, 0.2.0, 0.3.0, 0.4.0 | GHSA-77v5-hfrm-j4h4 | a92d3d4c…4e1ab6 | | yaml-report-formatter | 0.1.0, 0.2.0, 0.3.0 | GHSA-3q3w-rmgq-cq8x | 207190bd…50f01 | | yamlformat-tools | 0.1.0 | GHSA-fgh2-58j8-r2cq | 60b8ab6c…1b734 | | yamlformatter-utils | 1.0.0 | GHSA-rccj-4982-7jfw | ef2cbf7d…25cdc2 |

All five packages import-time collect sensitive host info and exfiltrate via DNS queries. Shared campaign identifier 2026-08-ekx-report-utils. The sap-quarterly-report name is a targeted lure at SAP finance shops; the three yaml* names (published 2026-08-28) confirm the operator did not stop at the 2026-08-27 batch and is iterating on report / formatter-flavoured lures aimed at Python BI / data / DevOps teams. DNS-based exfil bypasses HTTP-only egress proxies - internal DNS resolvers routinely forward externally. Discovery credit: kam193 (bad-packages.kam193.eu).

Cluster E - PyPI mathkitlite@0.1.0 PROBABLY_PENTEST

| Package | Version | GHSA | Source hash | |---|---|---|---| | mathkitlite | 0.1.0 | GHSA-j3j9-38mp-8cf7 | c91a8962…7845 |

Generic setup.py-override IP+username exfil. MAL-2026-14552. Low signal individually.

Cluster F - npm @vapi-ai/server-sdk formal GHSA backfill (folds into 2026-06-03 record)

GHSA-mjhg-2cvf-w2p4 formalises the Phantom Gyp / Miasma compromise of @vapi-ai/server-sdk and expands the tracked version set from 0.11.1 to 0.11.1, 0.11.2, 1.2.1, 1.2.2. The existing 2026-06-03 record (npm-2026-06-03-phantom-gyp-vapi-jagreehal) has been updated in place rather than duplicated here.

Cluster G - npm @postman-cse/okta-aio-darwin-arm64@<=0.11.6 internal-namespace probe

| Package | Versions | GHSA | Note | |---|---|---|---| | @postman-cse/okta-aio-darwin-arm64 | <= 0.11.6 | GHSA-2qc4-r3x2-xh47 | Reads as Postman internal CSE Okta-AIO darwin-arm64 platform binary |

Exactly the naming shape a Postman internal CI would pull-through if the private mirror briefly failed over to public. Postman-adjacent orgs: audit .npmrc scope-registry pins for @postman-cse.

Cluster H - npm @hd-team/* operator cluster (8 packages)

| Package | GHSA | |---|---| | @hd-team/app-impkg-prod | GHSA-g7cq-7vcf-rp48 | | @hd-team/app-dnpkg-beta | GHSA-6p53-v557-745c | | @hd-team/app-dnpkg-three | GHSA-qwcv-3958-fhq5 | | @hd-team/app-dnpkg-prod | GHSA-35w7-82wv-vwxj | | @hd-team/app-impkg-test | GHSA-hxxw-mprp-h9w7 | | @hd-team/app-dnpkg-ten | GHSA-q7mf-7f69-7qpr | | @hd-team/app-dnpkg-test | GHSA-6fm3-xp27-2556 | | @hd-team/app-dnpkg-eight | GHSA-97qc-463w-p2jr |

Eight coordinated advisories at one publisher account within one publish window; the app-impkg-* / app-dnpkg-* naming is throwaway boilerplate. Any lockfile hit under @hd-team should be uninstalled scope-wide.

Cluster I - npm hydration/svelte -ui-dlx extension

| Package | Versions | GHSA | |---|---|---| | hydration-ui-dlx | >= 0 | GHSA-j5x7-qc6j-xwg4 | | svelte-ui-dlx | >= 0 | GHSA-7qq8-vjh5-hpgw |

Extends the multi-week hydration-*-ui / svelte-*-ui lookalike campaign with a -dlx suffix mirroring npm dlx / pnpm dlx / bunx terminology.

Cluster J - npm tailwindcss-* typosquats

| Package | Versions | GHSA | |---|---|---| | tailwindcss-3d-animate | <= 1.1.0 | GHSA-683p-54mf-9297 | | tailwindcss-form-styles | <= 0.5.15 | GHSA-8wj9-gw6r-6vqh |

tailwindcss-* prefix leverages the Tailwind CSS plugin surface.

Cluster K - npm high-version-count takeovers

| Package | Versions | GHSA | Note | |---|---|---|---| | @fleetbo/svro | 0.0.2-0.0.42 (~35 versions) | GHSA-4hrx-gqq5-q956 | Maintainer-account takeover pattern | | @znan/wabot | 0.0.5-0.2.2-beta.3 (80+ versions) | GHSA-2jxx-8fv2-h8mj | Maintainer-account takeover pattern |

Version-count pattern is the tell of a maintainer-account takeover or a package published as malware from the outset. Treat every historical install as compromised.

Cluster L - npm pushgitquickx scattered-version takeover

| Package | Versions | GHSA | |---|---|---| | pushgitquickx | 1.0.0, 1.0.4-1.0.17 | GHSA-wx29-h78g-ww4f |

Unusual gap (1.0.0 flagged, 1.0.1-1.0.3 clean, then 1.0.4-1.0.17 all flagged) is consistent with a maintainer-account takeover mid-release-train.

Cluster M - npm 2026-08-27 boilerplate CWE-506 tail

| Package | GHSA | |---|---| | stackpaths | GHSA-6hcw-m358-fq4q | | inspectstack | GHSA-xjx7-pff2-34gp | | charclass | GHSA-ccgj-rp72-9hvj | | deepjoin | GHSA-37cw-jw3f-qf4v | | module-relpath | GHSA-pmg4-2q5x-v3x5 | | sigcheck | GHSA-qm8v-w5qj-32jq | | morglog | GHSA-v899-gp96-p5rv | | veloq | GHSA-gccc-9phc-w64p |

All >= 0, all CWE-506 boilerplate with no per-package IOCs.

Registry state

All 31 packages yanked from npm / PyPI during the 2026-08-27 / 2026-08-28 takedown windows. The Cluster F formal GHSA-mjhg-2cvf-w2p4 for @vapi-ai/server-sdk is a backfill - the actual malicious versions have been deprecated on the registry since 2026-06-04; the new advisory just means GHSA-consuming tools finally see them.

Related tracked activity

  • *`flyteplugins- dependency-confusion probe** (Cluster A): first observed grouping this operator against Flyte / Union.ai naming. Watch for follow-on publishes across other Flyte-adjacent scopes (flytekitplugins-, flyteidl-, flyteagent-*`).
  • Windows-targeted PyPI Discord/Roblox infostealers (Clusters B, C): discordnv and decoris operate in the same ecosystem-vertical as multiple 2022-2026 waves (Sonatype 2022 wave, Snyk 2022 wave); campaign identifier 2026-06-spaysrbdata links Cluster C to earlier spaysrbdata activity.
  • DNS-exfil PyPI campaigns (Cluster D): sap-quarterly-report and ekx-report-utils share the 2026-08-ekx-report-utils campaign. DNS-based exfil bypasses HTTP-only egress controls.
  • Vue/Svelte/Vite hydration lookalike burst continuation (Cluster I): direct continuation of the 2026-08-25 -> 2026-08-27 burst catalogued in multi-2026-08-25, multi-2026-08-26, and multi-2026-08-27. The -dlx suffix mirroring npm dlx terminology is the new twist.
  • Phantom Gyp / Miasma backfill (Cluster F): the new GHSA-mjhg-2cvf-w2p4 formalises versions that shipped 2026-06-03 - see npm-2026-06-03-phantom-gyp-vapi-jagreehal for the full attack chain.
  • Discovery credits: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector (Cluster B), kam193 (Clusters A, B, C, E).

Affected packages (36)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - PyPI `flyteplugins- dependency-confusion cluster (2026-08-28, 4 packages, all v2.6.10)**: flyteplugins-redis@2.6.10 (GHSA-23fv-6cgr-766g, source hash 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03), flyteplugins-agento11y@2.6.10 (GHSA-8cpp-43j8-xg7c, hash 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a), flyteplugins-nsight@2.6.10 (GHSA-33m6-gx9h-9qv5, hash 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129, MAL-2026-14583), flyteplugins-echo@2.6.10 (GHSA-gcjf-mv7f-ffmf, hash e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c). All four names pattern-match Flyte / Union.ai internal package naming (real flytekitplugins- and flyteplugins- packages exist on PyPI; canonical publisher is flyteorg). All four setup.py overrides exfiltrate host IP and OS username. **The identical 2.6.10 version pin across all four is the tell**: this is a dependency-confusion probe hoping Flyte / Union.ai internal CI would resolve 2.6.10` from PyPI instead of the internal index (2.6.10 likely mirrors a real internal Flyte version). OpenSSF classifies as PROBABLY_PENTEST but the target-selection is not accidental - a real hit would land arbitrary command execution on Flyte / Union.ai CI
  • Cluster B - PyPI discordnv@0.8.0 Discord+Roblox DPAPI infostealer (2026-08-27, 1 package, 1 version): discordnv@0.8.0 (GHSA-89r4-hq67-cfgq, hashes 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 (Amazon Inspector) and d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646 (kam193)). On import steals Discord authentication tokens across every installed Discord client, reads and DPAPI-decrypts Roblox robloxcookies.dat from multiple browsers, exfiltrates to a Discord webhook (discord.com/api/webhooks/1528403989983662194/...) and a Google Apps Script endpoint (script.google.com/macros/s/AKfycbwa.../exec). Persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry entry named discordnv. Any Windows host that ran pip install discordnv==0.8.0 should be considered credential-compromised for Discord and Roblox at minimum; the DPAPI reach also means anything protected by user-DPAPI (browser saved passwords, some VPN clients) is potentially reachable
  • Cluster C - PyPI decoris@0.3.0, 0.3.3 Roblox cookie exfil (2026-08-27, 1 package, 2 versions): decoris@0.3.0, 0.3.3 (GHSA-v4c9-8j66-3xg2, hash 1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973, campaign 2026-06-spaysrbdata). Roblox cookie infostealer targeting the same population as discordnv. Campaign identifier links back to a June 2026 spaysrbdata cluster - operator has been active for months. Move Roblox account cookies / revoke sessions from a clean host
  • *Cluster D - PyPI sap-quarterly-report + ekx-report-utils + `yaml DNS exfil family (2026-08-27 / 2026-08-28, 5 packages)**: sap-quarterly-report@1.0.0 (GHSA-3g4v-hc5w-c37x, hash 2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec), ekx-report-utils@0.1.0, 0.2.0, 0.3.0, 0.4.0 (GHSA-77v5-hfrm-j4h4, hash a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6), yaml-report-formatter@0.1.0, 0.2.0, 0.3.0 (GHSA-3q3w-rmgq-cq8x, hash 207190bd409999efcab9a56f8e536b6caf9c6a5ab92a134b77421f4bf1650f01, MAL-2026 series), yamlformat-tools@0.1.0 (GHSA-fgh2-58j8-r2cq, hash 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734) and yamlformatter-utils@1.0.0 (GHSA-rccj-4982-7jfw, hash ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2). All five import-time collect sensitive host info and exfiltrate via DNS queries - egress-firewall-bypass by encoding data into DNS subdomain labels. Shared campaign identifier 2026-08-ekx-report-utils groups them (the three yaml names published 2026-08-28 confirm the operator did not stop at the 08-27 batch and is iterating on report/formatter-flavoured lures). The sap-quarterly-report name is a targeted lure at SAP finance / accounting shops; ekx-report-utils and the yaml-report-formatter / yamlformat-tools/utils` names read like internal reporting helpers a Python data / BI shop would pull without a second look. DNS-based exfil is the important detail - a proxy-only egress policy does not block it if internal DNS resolvers forward externally. Discovery credit: kam193 (bad-packages.kam193.eu) plus GitHub Advisory Database / OpenSSF Package Analysis
  • Cluster E - PyPI mathkitlite@0.1.0 PROBABLY_PENTEST (2026-08-27, 1 package, 1 version): mathkitlite@0.1.0 (GHSA-j3j9-38mp-8cf7, hash c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845, MAL-2026-14552). setup.py override exfiltrates host IP and OS username at install time - the same generic PROBABLY_PENTEST shape as recent kam193 discoveries. Low signal individually but part of the persistent PyPI pentest-probe background
  • Cluster F - npm @vapi-ai/server-sdk formal GHSA backfill (2026-08-27, adds 3 more versions to 2026-06-03 Phantom Gyp wave): GHSA-mjhg-2cvf-w2p4 formalises the Phantom Gyp / Miasma compromise of @vapi-ai/server-sdk and adds versions 0.11.2, 1.2.1, 1.2.2 to the previously-tracked 0.11.1 - the existing 2026-06-03 record has been updated in place rather than duplicated here. Anyone still resolving those exact version pins from an internal mirror after 2026-06-04 remained exposed until the GHSA landed on 2026-08-27
  • Cluster G - npm @postman-cse/okta-aio-darwin-arm64@0.11.6- internal-namespace probe (2026-08-28, 1 package): @postman-cse/okta-aio-darwin-arm64 <= 0.11.6 (GHSA-2qc4-r3x2-xh47). Reads as a Postman internal Customer Success/Solution Engineering (cse) Okta All-In-One (aio) darwin-arm64 platform-specific binary sub-package - the exact namespace shape a Postman internal CI job could pull-through if the private mirror briefly failed over to the public registry. Whether the @postman-cse org is genuinely Postman-controlled or a squat of the naming pattern is not disclosed in the GHSA; treat any resolution of this scope in a build log as a private-registry misconfiguration to investigate. Postman-adjacent orgs should verify their .npmrc scope-registry pins
  • *Cluster H - npm `@hd-team/ operator cluster (2026-08-27, 8 packages)**: @hd-team/app-impkg-prod (GHSA-g7cq-7vcf-rp48), @hd-team/app-dnpkg-beta (GHSA-6p53-v557-745c), @hd-team/app-dnpkg-three (GHSA-qwcv-3958-fhq5), @hd-team/app-dnpkg-prod (GHSA-35w7-82wv-vwxj), @hd-team/app-impkg-test (GHSA-hxxw-mprp-h9w7), @hd-team/app-dnpkg-ten (GHSA-q7mf-7f69-7qpr), @hd-team/app-dnpkg-test (GHSA-6fm3-xp27-2556), @hd-team/app-dnpkg-eight (GHSA-97qc-463w-p2jr). Eight coordinated advisories at one publisher account within one publish window - the app-impkg- / app-dnpkg- naming pattern is throwaway boilerplate rather than a typosquat of any real package. CWE-506 boilerplate advisories only; the operational value is knowing the @hd-team` scope is entirely poisoned so any lockfile hit under that scope should be uninstalled, not selectively pinned
  • Cluster I - npm hydration/svelte -ui-dlx extension (2026-08-27, 2 packages): hydration-ui-dlx (GHSA-j5x7-qc6j-xwg4) and svelte-ui-dlx (GHSA-7qq8-vjh5-hpgw). Extends the multi-week hydration-*-ui / svelte-*-ui lookalike campaign (see multi-2026-08-25, multi-2026-08-26, multi-2026-08-27 sweeps) with a new -dlx suffix mirroring npm dlx / pnpm dlx / bunx terminology. CWE-506 boilerplate; no per-package IOCs. Watch for further <framework>-*-dlx publishes across the same campaign
  • Cluster J - npm tailwindcss-3d-animate + tailwindcss-form-styles typosquats (2026-08-27, 2 packages): tailwindcss-3d-animate <= 1.1.0 (GHSA-683p-54mf-9297) and tailwindcss-form-styles <= 0.5.15 (GHSA-8wj9-gw6r-6vqh). tailwindcss-* prefix leverages the massive Tailwind CSS plugin surface; developers searching for a 3D animate plugin or form-styling plugin will find these ahead of legitimate options. Boilerplate CWE-506 with no per-package IOCs; treat as tailwindcss-* prefix hygiene reminder
  • Cluster K - npm high-version-count boilerplate takeovers (2026-08-28, 2 packages): @fleetbo/svro@0.0.2-0.0.42 (GHSA-4hrx-gqq5-q956, ~35 versions) and @znan/wabot@0.0.5-0.2.2-beta.3 (GHSA-2jxx-8fv2-h8mj, 80+ versions). The version-count pattern (many published versions over months, all now flagged) is the tell of a maintainer-account takeover or a maintainer publishing malware from the outset and only now getting caught. Any project holding either package in a lockfile should treat every historical install as compromised, not just the most recent version
  • Cluster L - npm pushgitquickx scattered-version takeover (2026-08-27, 1 package): pushgitquickx@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17 (GHSA-wx29-h78g-ww4f). The unusual gap (1.0.0 flagged, 1.0.1-1.0.3 clean, then 1.0.4-1.0.17 all flagged) is consistent with a maintainer-account takeover mid-release-train: an attacker got the publish token and shipped every subsequent patch until the account was locked. git-themed name (push-git-quick-x) suggests targeting developers looking for git-related tooling
  • Cluster M - npm 2026-08-27 boilerplate CWE-506 tail (8 packages): stackpaths (GHSA-6hcw-m358-fq4q), inspectstack (GHSA-xjx7-pff2-34gp), charclass (GHSA-ccgj-rp72-9hvj), deepjoin (GHSA-37cw-jw3f-qf4v), module-relpath (GHSA-pmg4-2q5x-v3x5), sigcheck (GHSA-qm8v-w5qj-32jq), morglog (GHSA-v899-gp96-p5rv), veloq (GHSA-gccc-9phc-w64p). All >= 0, all CWE-506 boilerplate with no per-package IOCs. The mix of utility-sounding names (stackpaths, inspectstack, module-relpath, sigcheck) suggests scripted name-generation targeting developer search terms rather than specific typosquats

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: flyteplugins-redis, flyteplugins-agento11y, flyteplugins-nsight, flyteplugins-echo, discordnv, decoris, sap-quarterly-report, ekx-report-utils, yaml-report-formatter, yamlformat-tools, yamlformatter-utils, mathkitlite, @postman-cse/okta-aio-darwin-arm64, @hd-team/app-impkg-prod, @hd-team/app-dnpkg-beta, @hd-team/app-dnpkg-three, @hd-team/app-dnpkg-prod, @hd-team/app-impkg-test, @hd-team/app-dnpkg-ten, @hd-team/app-dnpkg-test, @hd-team/app-dnpkg-eight, hydration-ui-dlx, svelte-ui-dlx, tailwindcss-3d-animate, tailwindcss-form-styles, @fleetbo/svro, @znan/wabot, pushgitquickx, stackpaths, inspectstack, charclass, deepjoin, module-relpath, sigcheck, morglog, veloq
  2. 2*For Cluster A (`flyteplugins- dependency-confusion probe)**: any organisation that runs Flyte / Union.ai internally MUST audit their pip / uv resolver configuration. Verify flytekitplugins- and flyteplugins- resolve exclusively to the canonical flyteorg publisher on the internal index. Pin --index-url (not --extra-index-url) to the internal mirror for CI runs of Flyte-adjacent code, so pip cannot silently fall through to PyPI. pip install --dry-run` a Flyte requirements set against a scratch env pointing only at PyPI to see whether the confused version resolves - if 2.6.10 comes back for any of the four flagged names, the attack shape is confirmed against your naming set
  3. 3For Cluster B (discordnv Discord+Roblox DPAPI stealer): any Windows user who ran pip install discordnv==0.8.0 should reset Discord (log out all sessions, rotate token by password change), revoke Roblox sessions, and remove the persistence entry at HKCU\Software\Microsoft\Windows\CurrentVersion\Run\discordnv. Because the payload DPAPI-decrypts under the user profile, browser saved passwords for that user are also at risk - a browser password rotation from a clean host is a reasonable defensive move. Block the Discord webhook URL and the Google Apps Script endpoint at egress if you have a proxy
  4. 4For Cluster C (decoris Roblox cookie exfil): revoke Roblox sessions from a clean host, uninstall the package, and hunt for prior versions of the same operator's campaign identifier 2026-06-spaysrbdata in historical pip install logs
  5. 5*For Cluster D (sap-quarterly-report + ekx-report-utils + `yaml DNS exfil family)**: SAP finance / reporting and Python BI shops should verify these did not slip into any BI / finance-team pip install workflow. **DNS-based exfil bypasses HTTP-only egress proxies**: if your egress policy is proxy-only, verify your internal DNS resolvers do not forward externally-resolvable domains for pip-installer-user contexts; or add a DNS-egress-block for these campaign domains once IOCs are published. Because the operator is iterating on report/format/formatter/utils themes across multiple publish windows, extend the block-list beyond the exact names to any -report- / format-utils / yamlformat` install requested by an environment that should never touch these
  6. 6For Cluster E (mathkitlite PROBABLY_PENTEST): uninstall from every environment. pip install --only-binary=:all: in CI helps against setup.py payloads that only trigger from sdist installs
  7. 7For Cluster G (@postman-cse/okta-aio-darwin-arm64): any Postman-adjacent org should audit .npmrc for a scope-registry pin (@postman-cse:registry=https://...) and verify that scope is not resolvable from the public registry - the okta-aio-darwin-arm64 naming is exactly what a platform-specific internal binary package would look like, and a build box briefly failing over to the public registry would land the malicious version
  8. 8*For Cluster H (`@hd-team/)**: treat the entire @hd-team` scope as poisoned. If any lockfile pins a package under this scope, uninstall the whole scope rather than trying to identify which subset is malicious - all 8 flagged siblings are boilerplate CWE-506 with no per-package IOCs, and the operator can publish more under the same account until the account is locked
  9. 9For Clusters I, J, K, L, M: uninstall on hit and rebuild lockfiles. For high-version-count Cluster K takeovers, treat every historical install of @fleetbo/svro or @znan/wabot as compromised, not just the most recent version
  10. 10For all pip install runs in CI, prefer --only-binary=:all: and pin to source hashes - Clusters A, B, C, D, E all execute at install time via setup.py or wheel side-effects. For flyteplugins-* shops, also lock the resolver to a single trusted index
  11. 11For all npm install runs in CI, run with --ignore-scripts where possible - though the @hd-team and hydration-* clusters have no published IOCs, so scope-blocking at the private mirror is a stronger control
  12. 12Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-28-ghsa-malware-sweep