# GitHub Advisory malware sweep, 28 August 2026

> 31 new GHSA malware advisories in the 24h window ending 2026-08-28. Highlights: 4 `flyteplugins-*` PyPI packages all published at the identical exact version `2.6.10` - a dependency-confusion probe against Union.ai / Flyte internal package namespaces; PyPI `discordnv@0.8.0` steals Discord tokens plus DPAPI-decrypts Roblox cookies with full Discord-webhook + Google-Apps-Script + registry-persistence IOCs; PyPI `sap-quarterly-report` + `ekx-report-utils` share a DNS-exfil campaign; npm `@postman-cse/okta-aio-darwin-arm64` reads as a Postman internal `okta-aio` binary namespace hit.

- Published: 2026-08-28
- Last updated: 2026-08-29
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 36 packages, 68 compromised versions
- Tags: dependency-confusion, infostealer, credential-theft, typosquat, account-takeover, dns-exfiltration, obfuscation
- Also known as: 2026-08-28 GHSA sweep, 2026-08-flyteplugins dependency-confusion, 2026-08-discordnv Discord Roblox stealer, 2026-06-spaysrbdata, 2026-08-ekx-report-utils, @postman-cse okta-aio internal-namespace probe
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193
- Incident ID: multi-2026-08-28-ghsa-malware-sweep

## Affected packages (36)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@fleetbo/svro](https://dependencywatch.io/package/npm/@fleetbo/svro) | npm | 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.9, 0.0.10, 0.0.11, 0.0.12, 0.0.13, 0.0.14, 0.0.15, 0.0.16, 0.0.17, 0.0.19, 0.0.20, 0.0.21, 0.0.22, 0.0.23, 0.0.24, 0.0.26, 0.0.27, 0.0.29, 0.0.30, 0.0.31, 0.0.32, 0.0.33, 0.0.34, 0.0.35, 0.0.37, 0.0.38, 0.0.39, 0.0.40, 0.0.42 |
| [@hd-team/app-dnpkg-beta](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-beta) | npm |  |
| [@hd-team/app-dnpkg-eight](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-eight) | npm |  |
| [@hd-team/app-dnpkg-prod](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-prod) | npm |  |
| [@hd-team/app-dnpkg-ten](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-ten) | npm |  |
| [@hd-team/app-dnpkg-test](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-test) | npm |  |
| [@hd-team/app-dnpkg-three](https://dependencywatch.io/package/npm/@hd-team/app-dnpkg-three) | npm |  |
| [@hd-team/app-impkg-prod](https://dependencywatch.io/package/npm/@hd-team/app-impkg-prod) | npm |  |
| [@hd-team/app-impkg-test](https://dependencywatch.io/package/npm/@hd-team/app-impkg-test) | npm |  |
| [@postman-cse/okta-aio-darwin-arm64](https://dependencywatch.io/package/npm/@postman-cse/okta-aio-darwin-arm64) | npm |  |
| [@znan/wabot](https://dependencywatch.io/package/npm/@znan/wabot) | npm |  |
| [charclass](https://dependencywatch.io/package/npm/charclass) | npm |  |
| [decoris](https://dependencywatch.io/package/pypi/decoris) | PyPI | 0.3.0, 0.3.3 |
| [deepjoin](https://dependencywatch.io/package/npm/deepjoin) | npm |  |
| [discordnv](https://dependencywatch.io/package/pypi/discordnv) | PyPI | 0.8.0 |
| [ekx-report-utils](https://dependencywatch.io/package/pypi/ekx-report-utils) | PyPI | 0.1.0, 0.2.0, 0.3.0, 0.4.0 |
| [flyteplugins-agento11y](https://dependencywatch.io/package/pypi/flyteplugins-agento11y) | PyPI | 2.6.10 |
| [flyteplugins-echo](https://dependencywatch.io/package/pypi/flyteplugins-echo) | PyPI | 2.6.10 |
| [flyteplugins-nsight](https://dependencywatch.io/package/pypi/flyteplugins-nsight) | PyPI | 2.6.10 |
| [flyteplugins-redis](https://dependencywatch.io/package/pypi/flyteplugins-redis) | PyPI | 2.6.10 |
| [hydration-ui-dlx](https://dependencywatch.io/package/npm/hydration-ui-dlx) | npm |  |
| [inspectstack](https://dependencywatch.io/package/npm/inspectstack) | npm |  |
| [mathkitlite](https://dependencywatch.io/package/pypi/mathkitlite) | PyPI | 0.1.0 |
| [module-relpath](https://dependencywatch.io/package/npm/module-relpath) | npm |  |
| [morglog](https://dependencywatch.io/package/npm/morglog) | npm |  |
| [pushgitquickx](https://dependencywatch.io/package/npm/pushgitquickx) | npm | 1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17 |
| [sap-quarterly-report](https://dependencywatch.io/package/pypi/sap-quarterly-report) | PyPI | 1.0.0 |
| [sigcheck](https://dependencywatch.io/package/npm/sigcheck) | npm |  |
| [stackpaths](https://dependencywatch.io/package/npm/stackpaths) | npm |  |
| [svelte-ui-dlx](https://dependencywatch.io/package/npm/svelte-ui-dlx) | npm |  |
| [tailwindcss-3d-animate](https://dependencywatch.io/package/npm/tailwindcss-3d-animate) | npm |  |
| [tailwindcss-form-styles](https://dependencywatch.io/package/npm/tailwindcss-form-styles) | npm |  |
| [veloq](https://dependencywatch.io/package/npm/veloq) | npm |  |
| [yaml-report-formatter](https://dependencywatch.io/package/pypi/yaml-report-formatter) | PyPI | 0.1.0, 0.2.0, 0.3.0 |
| [yamlformat-tools](https://dependencywatch.io/package/pypi/yamlformat-tools) | PyPI | 0.1.0 |
| [yamlformatter-utils](https://dependencywatch.io/package/pypi/yamlformatter-utils) | PyPI | 1.0.0 |

## What happened

The 24-hour window ending 2026-08-28 06:00 UTC published **31 new GHSA malware advisories** across npm and PyPI. (Updated 2026-08-29: three additional PyPI packages - `yaml-report-formatter`, `yamlformat-tools`, `yamlformatter-utils` - published later on 2026-08-28 have been added to Cluster D under the shared `2026-08-ekx-report-utils` campaign identifier.) The window is dominated by two organised campaigns - a PyPI `flyteplugins-*` dependency-confusion probe (4 identical-version publishes against the Flyte / Union.ai internal package namespace) and a Windows-targeted Discord+Roblox infostealer with full IOCs - plus the routine boilerplate CWE-506 tail.

## Cluster A - PyPI `flyteplugins-*` dependency-confusion cluster (Union.ai / Flyte target)

| Package | Version | GHSA | Source hash |
|---|---|---|---|
| `flyteplugins-redis` | `2.6.10` | GHSA-23fv-6cgr-766g | `785b972d…64c03` |
| `flyteplugins-agento11y` | `2.6.10` | GHSA-8cpp-43j8-xg7c | `46ad72ab…66c09a` |
| `flyteplugins-nsight` | `2.6.10` | GHSA-33m6-gx9h-9qv5 | `46b08f15…f2f129` |
| `flyteplugins-echo` | `2.6.10` | GHSA-gcjf-mv7f-ffmf | `e40fe85c…78b85c` |

All four `setup.py` overrides exfiltrate host IP and OS username. The identical `2.6.10` version pin across all four is the tell: this is a dependency-confusion probe against the Flyte / Union.ai internal package namespace. Canonical Flyte plugin packages are published as `flytekitplugins-*` and `flyteplugins-*` under the `flyteorg` publisher; the target-selection here mirrors that pattern exactly (a `redis` connector, an `agent` observability helper, an `nsight` NVIDIA profiler integration, an `echo` test plugin - all names a real internal Flyte plugin catalogue would carry). OpenSSF classifies as PROBABLY_PENTEST but if any Flyte-shop CI is misconfigured to fall through to PyPI on internal-index failure, the setup.py exfil is a real hit and a follow-on payload could ship arbitrary code.

## Cluster B - PyPI `discordnv@0.8.0` Discord+Roblox DPAPI infostealer

| Package | Version | GHSA | Amazon Inspector hash | kam193 hash |
|---|---|---|---|---|
| `discordnv` | `0.8.0` | GHSA-89r4-hq67-cfgq | `2f791396…3ba48` | `d28ded2c…92f3646` |

**IOCs**: Discord webhook `discord.com/api/webhooks/1528403989983662194/...`; Google Apps Script `script.google.com/macros/s/AKfycbwa.../exec`; Windows registry persistence `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\discordnv`.

On import, steals Discord authentication tokens across every installed Discord client and DPAPI-decrypts Roblox `robloxcookies.dat` from multiple browsers. Because the payload DPAPI-decrypts under the user profile, browser saved passwords for that user are also at risk. Windows-targeted.

## Cluster C - PyPI `decoris@0.3.0, 0.3.3` Roblox cookie exfil

| Package | Versions | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `decoris` | `0.3.0, 0.3.3` | GHSA-v4c9-8j66-3xg2 | `1ce74b34…d9973` | `2026-06-spaysrbdata` |

Roblox cookie infostealer, same population as `discordnv`. Campaign identifier links back to a June 2026 `spaysrbdata` cluster (kam193 discovery).

## Cluster D - PyPI `sap-quarterly-report` + `ekx-report-utils` + `yaml*` DNS exfil family (shared campaign)

| Package | Versions | GHSA | Source hash |
|---|---|---|---|
| `sap-quarterly-report` | `1.0.0` | GHSA-3g4v-hc5w-c37x | `2235bdf8…567b37ec` |
| `ekx-report-utils` | `0.1.0, 0.2.0, 0.3.0, 0.4.0` | GHSA-77v5-hfrm-j4h4 | `a92d3d4c…4e1ab6` |
| `yaml-report-formatter` | `0.1.0, 0.2.0, 0.3.0` | GHSA-3q3w-rmgq-cq8x | `207190bd…50f01` |
| `yamlformat-tools` | `0.1.0` | GHSA-fgh2-58j8-r2cq | `60b8ab6c…1b734` |
| `yamlformatter-utils` | `1.0.0` | GHSA-rccj-4982-7jfw | `ef2cbf7d…25cdc2` |

All five packages import-time collect sensitive host info and exfiltrate via DNS queries. Shared campaign identifier `2026-08-ekx-report-utils`. The `sap-quarterly-report` name is a targeted lure at SAP finance shops; the three `yaml*` names (published 2026-08-28) confirm the operator did not stop at the 2026-08-27 batch and is iterating on report / formatter-flavoured lures aimed at Python BI / data / DevOps teams. **DNS-based exfil bypasses HTTP-only egress proxies** - internal DNS resolvers routinely forward externally. Discovery credit: kam193 (bad-packages.kam193.eu).

## Cluster E - PyPI `mathkitlite@0.1.0` PROBABLY_PENTEST

| Package | Version | GHSA | Source hash |
|---|---|---|---|
| `mathkitlite` | `0.1.0` | GHSA-j3j9-38mp-8cf7 | `c91a8962…7845` |

Generic `setup.py`-override IP+username exfil. MAL-2026-14552. Low signal individually.

## Cluster F - npm `@vapi-ai/server-sdk` formal GHSA backfill (folds into 2026-06-03 record)

GHSA-mjhg-2cvf-w2p4 formalises the Phantom Gyp / Miasma compromise of `@vapi-ai/server-sdk` and expands the tracked version set from `0.11.1` to `0.11.1, 0.11.2, 1.2.1, 1.2.2`. The existing 2026-06-03 record ([npm-2026-06-03-phantom-gyp-vapi-jagreehal](https://dependencywatch.io/incident/npm-2026-06-03-phantom-gyp-vapi-jagreehal)) has been updated in place rather than duplicated here.

## Cluster G - npm `@postman-cse/okta-aio-darwin-arm64@<=0.11.6` internal-namespace probe

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `@postman-cse/okta-aio-darwin-arm64` | `<= 0.11.6` | GHSA-2qc4-r3x2-xh47 | Reads as Postman internal CSE Okta-AIO darwin-arm64 platform binary |

Exactly the naming shape a Postman internal CI would pull-through if the private mirror briefly failed over to public. Postman-adjacent orgs: audit `.npmrc` scope-registry pins for `@postman-cse`.

## Cluster H - npm `@hd-team/*` operator cluster (8 packages)

| Package | GHSA |
|---|---|
| `@hd-team/app-impkg-prod` | GHSA-g7cq-7vcf-rp48 |
| `@hd-team/app-dnpkg-beta` | GHSA-6p53-v557-745c |
| `@hd-team/app-dnpkg-three` | GHSA-qwcv-3958-fhq5 |
| `@hd-team/app-dnpkg-prod` | GHSA-35w7-82wv-vwxj |
| `@hd-team/app-impkg-test` | GHSA-hxxw-mprp-h9w7 |
| `@hd-team/app-dnpkg-ten` | GHSA-q7mf-7f69-7qpr |
| `@hd-team/app-dnpkg-test` | GHSA-6fm3-xp27-2556 |
| `@hd-team/app-dnpkg-eight` | GHSA-97qc-463w-p2jr |

Eight coordinated advisories at one publisher account within one publish window; the `app-impkg-*` / `app-dnpkg-*` naming is throwaway boilerplate. Any lockfile hit under `@hd-team` should be uninstalled scope-wide.

## Cluster I - npm hydration/svelte `-ui-dlx` extension

| Package | Versions | GHSA |
|---|---|---|
| `hydration-ui-dlx` | `>= 0` | GHSA-j5x7-qc6j-xwg4 |
| `svelte-ui-dlx` | `>= 0` | GHSA-7qq8-vjh5-hpgw |

Extends the multi-week `hydration-*-ui` / `svelte-*-ui` lookalike campaign with a `-dlx` suffix mirroring `npm dlx` / `pnpm dlx` / `bunx` terminology.

## Cluster J - npm `tailwindcss-*` typosquats

| Package | Versions | GHSA |
|---|---|---|
| `tailwindcss-3d-animate` | `<= 1.1.0` | GHSA-683p-54mf-9297 |
| `tailwindcss-form-styles` | `<= 0.5.15` | GHSA-8wj9-gw6r-6vqh |

`tailwindcss-*` prefix leverages the Tailwind CSS plugin surface.

## Cluster K - npm high-version-count takeovers

| Package | Versions | GHSA | Note |
|---|---|---|---|
| `@fleetbo/svro` | `0.0.2-0.0.42` (~35 versions) | GHSA-4hrx-gqq5-q956 | Maintainer-account takeover pattern |
| `@znan/wabot` | `0.0.5-0.2.2-beta.3` (80+ versions) | GHSA-2jxx-8fv2-h8mj | Maintainer-account takeover pattern |

Version-count pattern is the tell of a **maintainer-account takeover** or a package published as malware from the outset. Treat every historical install as compromised.

## Cluster L - npm `pushgitquickx` scattered-version takeover

| Package | Versions | GHSA |
|---|---|---|
| `pushgitquickx` | `1.0.0, 1.0.4-1.0.17` | GHSA-wx29-h78g-ww4f |

Unusual gap (1.0.0 flagged, 1.0.1-1.0.3 clean, then 1.0.4-1.0.17 all flagged) is consistent with a maintainer-account takeover mid-release-train.

## Cluster M - npm 2026-08-27 boilerplate CWE-506 tail

| Package | GHSA |
|---|---|
| `stackpaths` | GHSA-6hcw-m358-fq4q |
| `inspectstack` | GHSA-xjx7-pff2-34gp |
| `charclass` | GHSA-ccgj-rp72-9hvj |
| `deepjoin` | GHSA-37cw-jw3f-qf4v |
| `module-relpath` | GHSA-pmg4-2q5x-v3x5 |
| `sigcheck` | GHSA-qm8v-w5qj-32jq |
| `morglog` | GHSA-v899-gp96-p5rv |
| `veloq` | GHSA-gccc-9phc-w64p |

All `>= 0`, all CWE-506 boilerplate with no per-package IOCs.

## Registry state

All 31 packages yanked from npm / PyPI during the 2026-08-27 / 2026-08-28 takedown windows. The Cluster F formal GHSA-mjhg-2cvf-w2p4 for `@vapi-ai/server-sdk` is a **backfill** - the actual malicious versions have been deprecated on the registry since 2026-06-04; the new advisory just means GHSA-consuming tools finally see them.

## Related tracked activity

- **`flyteplugins-*` dependency-confusion probe** (Cluster A): first observed grouping this operator against Flyte / Union.ai naming. Watch for follow-on publishes across other Flyte-adjacent scopes (`flytekitplugins-*`, `flyteidl-*`, `flyteagent-*`).
- **Windows-targeted PyPI Discord/Roblox infostealers** (Clusters B, C): `discordnv` and `decoris` operate in the same ecosystem-vertical as multiple 2022-2026 waves ([Sonatype 2022 wave](https://www.sonatype.com/blog/malicious-roblox-cookie-and-discord-token-stealers-hit-pypi-repository), [Snyk 2022 wave](https://labs.snyk.io/resources/pypi-malware-discord-roblox-credential-payment-info/)); campaign identifier `2026-06-spaysrbdata` links Cluster C to earlier `spaysrbdata` activity.
- **DNS-exfil PyPI campaigns** (Cluster D): `sap-quarterly-report` and `ekx-report-utils` share the `2026-08-ekx-report-utils` campaign. DNS-based exfil bypasses HTTP-only egress controls.
- **Vue/Svelte/Vite hydration lookalike burst continuation** (Cluster I): direct continuation of the 2026-08-25 -> 2026-08-27 burst catalogued in [multi-2026-08-25](https://dependencywatch.io/incident/multi-2026-08-25-ghsa-malware-sweep), [multi-2026-08-26](https://dependencywatch.io/incident/multi-2026-08-26-ghsa-malware-sweep), and [multi-2026-08-27](https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep). The `-dlx` suffix mirroring `npm dlx` terminology is the new twist.
- **Phantom Gyp / Miasma backfill** (Cluster F): the new GHSA-mjhg-2cvf-w2p4 formalises versions that shipped 2026-06-03 - see [npm-2026-06-03-phantom-gyp-vapi-jagreehal](https://dependencywatch.io/incident/npm-2026-06-03-phantom-gyp-vapi-jagreehal) for the full attack chain.
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector` (Cluster B), `kam193` (Clusters A, B, C, E).

## Impact

- **Cluster A - PyPI `flyteplugins-*` dependency-confusion cluster (2026-08-28, 4 packages, all v2.6.10)**: `flyteplugins-redis@2.6.10` (GHSA-23fv-6cgr-766g, source hash `785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03`), `flyteplugins-agento11y@2.6.10` (GHSA-8cpp-43j8-xg7c, hash `46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a`), `flyteplugins-nsight@2.6.10` (GHSA-33m6-gx9h-9qv5, hash `46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129`, MAL-2026-14583), `flyteplugins-echo@2.6.10` (GHSA-gcjf-mv7f-ffmf, hash `e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c`). All four names pattern-match Flyte / Union.ai internal package naming (real `flytekitplugins-*` and `flyteplugins-*` packages exist on PyPI; canonical publisher is `flyteorg`). All four `setup.py` overrides exfiltrate host IP and OS username. **The identical `2.6.10` version pin across all four is the tell**: this is a dependency-confusion probe hoping Flyte / Union.ai internal CI would resolve `2.6.10` from PyPI instead of the internal index (2.6.10 likely mirrors a real internal Flyte version). OpenSSF classifies as PROBABLY_PENTEST but the target-selection is not accidental - a real hit would land arbitrary command execution on Flyte / Union.ai CI
- **Cluster B - PyPI `discordnv@0.8.0` Discord+Roblox DPAPI infostealer (2026-08-27, 1 package, 1 version)**: `discordnv@0.8.0` (GHSA-89r4-hq67-cfgq, hashes `2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48` (Amazon Inspector) and `d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646` (kam193)). On import steals Discord authentication tokens across every installed Discord client, reads and DPAPI-decrypts Roblox `robloxcookies.dat` from multiple browsers, exfiltrates to a Discord webhook (`discord.com/api/webhooks/1528403989983662194/...`) and a Google Apps Script endpoint (`script.google.com/macros/s/AKfycbwa.../exec`). Persistence via `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry entry named `discordnv`. Any Windows host that ran `pip install discordnv==0.8.0` should be considered credential-compromised for Discord and Roblox at minimum; the DPAPI reach also means anything protected by user-DPAPI (browser saved passwords, some VPN clients) is potentially reachable
- **Cluster C - PyPI `decoris@0.3.0, 0.3.3` Roblox cookie exfil (2026-08-27, 1 package, 2 versions)**: `decoris@0.3.0, 0.3.3` (GHSA-v4c9-8j66-3xg2, hash `1ce74b34855100b6ba312f767a982fb288a802da613fec375aec92665f4d9973`, campaign `2026-06-spaysrbdata`). Roblox cookie infostealer targeting the same population as `discordnv`. Campaign identifier links back to a June 2026 `spaysrbdata` cluster - operator has been active for months. Move Roblox account cookies / revoke sessions from a clean host
- **Cluster D - PyPI `sap-quarterly-report` + `ekx-report-utils` + `yaml*` DNS exfil family (2026-08-27 / 2026-08-28, 5 packages)**: `sap-quarterly-report@1.0.0` (GHSA-3g4v-hc5w-c37x, hash `2235bdf8263c08fede094c665d2fbc4e023a0f0c5e99631d70ae0685567b37ec`), `ekx-report-utils@0.1.0, 0.2.0, 0.3.0, 0.4.0` (GHSA-77v5-hfrm-j4h4, hash `a92d3d4cf522a2a5c2b690f54b14b8312d54b16208b92c8e5540a49fbc4e1ab6`), `yaml-report-formatter@0.1.0, 0.2.0, 0.3.0` (GHSA-3q3w-rmgq-cq8x, hash `207190bd409999efcab9a56f8e536b6caf9c6a5ab92a134b77421f4bf1650f01`, MAL-2026 series), `yamlformat-tools@0.1.0` (GHSA-fgh2-58j8-r2cq, hash `60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734`) and `yamlformatter-utils@1.0.0` (GHSA-rccj-4982-7jfw, hash `ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2`). All five import-time collect sensitive host info and exfiltrate via DNS queries - egress-firewall-bypass by encoding data into DNS subdomain labels. Shared campaign identifier `2026-08-ekx-report-utils` groups them (the three `yaml*` names published 2026-08-28 confirm the operator did not stop at the 08-27 batch and is iterating on report/formatter-flavoured lures). The `sap-quarterly-report` name is a targeted lure at SAP finance / accounting shops; `ekx-report-utils` and the `yaml*-report-formatter` / `yaml*format*-tools/utils` names read like internal reporting helpers a Python data / BI shop would pull without a second look. DNS-based exfil is the important detail - a proxy-only egress policy does not block it if internal DNS resolvers forward externally. Discovery credit: kam193 (bad-packages.kam193.eu) plus GitHub Advisory Database / OpenSSF Package Analysis
- **Cluster E - PyPI `mathkitlite@0.1.0` PROBABLY_PENTEST (2026-08-27, 1 package, 1 version)**: `mathkitlite@0.1.0` (GHSA-j3j9-38mp-8cf7, hash `c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845`, MAL-2026-14552). `setup.py` override exfiltrates host IP and OS username at install time - the same generic `PROBABLY_PENTEST` shape as recent kam193 discoveries. Low signal individually but part of the persistent PyPI pentest-probe background
- **Cluster F - npm `@vapi-ai/server-sdk` formal GHSA backfill (2026-08-27, adds 3 more versions to 2026-06-03 Phantom Gyp wave)**: GHSA-mjhg-2cvf-w2p4 formalises the Phantom Gyp / Miasma compromise of `@vapi-ai/server-sdk` and adds versions `0.11.2, 1.2.1, 1.2.2` to the previously-tracked `0.11.1` - the existing 2026-06-03 record has been updated in place rather than duplicated here. Anyone still resolving those exact version pins from an internal mirror after 2026-06-04 remained exposed until the GHSA landed on 2026-08-27
- **Cluster G - npm `@postman-cse/okta-aio-darwin-arm64@0.11.6-` internal-namespace probe (2026-08-28, 1 package)**: `@postman-cse/okta-aio-darwin-arm64` <= `0.11.6` (GHSA-2qc4-r3x2-xh47). Reads as a Postman internal Customer Success/Solution Engineering (`cse`) Okta All-In-One (`aio`) darwin-arm64 platform-specific binary sub-package - the exact namespace shape a Postman internal CI job could pull-through if the private mirror briefly failed over to the public registry. Whether the `@postman-cse` org is genuinely Postman-controlled or a squat of the naming pattern is not disclosed in the GHSA; treat any resolution of this scope in a build log as a private-registry misconfiguration to investigate. Postman-adjacent orgs should verify their `.npmrc` scope-registry pins
- **Cluster H - npm `@hd-team/*` operator cluster (2026-08-27, 8 packages)**: `@hd-team/app-impkg-prod` (GHSA-g7cq-7vcf-rp48), `@hd-team/app-dnpkg-beta` (GHSA-6p53-v557-745c), `@hd-team/app-dnpkg-three` (GHSA-qwcv-3958-fhq5), `@hd-team/app-dnpkg-prod` (GHSA-35w7-82wv-vwxj), `@hd-team/app-impkg-test` (GHSA-hxxw-mprp-h9w7), `@hd-team/app-dnpkg-ten` (GHSA-q7mf-7f69-7qpr), `@hd-team/app-dnpkg-test` (GHSA-6fm3-xp27-2556), `@hd-team/app-dnpkg-eight` (GHSA-97qc-463w-p2jr). Eight coordinated advisories at one publisher account within one publish window - the `app-impkg-*` / `app-dnpkg-*` naming pattern is throwaway boilerplate rather than a typosquat of any real package. CWE-506 boilerplate advisories only; the operational value is knowing the `@hd-team` scope is entirely poisoned so any lockfile hit under that scope should be uninstalled, not selectively pinned
- **Cluster I - npm hydration/svelte `-ui-dlx` extension (2026-08-27, 2 packages)**: `hydration-ui-dlx` (GHSA-j5x7-qc6j-xwg4) and `svelte-ui-dlx` (GHSA-7qq8-vjh5-hpgw). Extends the multi-week `hydration-*-ui` / `svelte-*-ui` lookalike campaign (see `multi-2026-08-25`, `multi-2026-08-26`, `multi-2026-08-27` sweeps) with a new `-dlx` suffix mirroring `npm dlx` / `pnpm dlx` / `bunx` terminology. CWE-506 boilerplate; no per-package IOCs. Watch for further `<framework>-*-dlx` publishes across the same campaign
- **Cluster J - npm `tailwindcss-3d-animate` + `tailwindcss-form-styles` typosquats (2026-08-27, 2 packages)**: `tailwindcss-3d-animate` <= `1.1.0` (GHSA-683p-54mf-9297) and `tailwindcss-form-styles` <= `0.5.15` (GHSA-8wj9-gw6r-6vqh). `tailwindcss-*` prefix leverages the massive Tailwind CSS plugin surface; developers searching for a 3D animate plugin or form-styling plugin will find these ahead of legitimate options. Boilerplate CWE-506 with no per-package IOCs; treat as `tailwindcss-*` prefix hygiene reminder
- **Cluster K - npm high-version-count boilerplate takeovers (2026-08-28, 2 packages)**: `@fleetbo/svro@0.0.2-0.0.42` (GHSA-4hrx-gqq5-q956, ~35 versions) and `@znan/wabot@0.0.5-0.2.2-beta.3` (GHSA-2jxx-8fv2-h8mj, 80+ versions). The version-count pattern (many published versions over months, all now flagged) is the tell of a **maintainer-account takeover** or a maintainer publishing malware from the outset and only now getting caught. Any project holding either package in a lockfile should treat every historical install as compromised, not just the most recent version
- **Cluster L - npm `pushgitquickx` scattered-version takeover (2026-08-27, 1 package)**: `pushgitquickx@1.0.0, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10, 1.0.11, 1.0.12, 1.0.13, 1.0.14, 1.0.15, 1.0.16, 1.0.17` (GHSA-wx29-h78g-ww4f). The unusual gap (1.0.0 flagged, 1.0.1-1.0.3 clean, then 1.0.4-1.0.17 all flagged) is consistent with a maintainer-account takeover mid-release-train: an attacker got the publish token and shipped every subsequent patch until the account was locked. `git`-themed name (`push-git-quick-x`) suggests targeting developers looking for `git`-related tooling
- **Cluster M - npm 2026-08-27 boilerplate CWE-506 tail (8 packages)**: `stackpaths` (GHSA-6hcw-m358-fq4q), `inspectstack` (GHSA-xjx7-pff2-34gp), `charclass` (GHSA-ccgj-rp72-9hvj), `deepjoin` (GHSA-37cw-jw3f-qf4v), `module-relpath` (GHSA-pmg4-2q5x-v3x5), `sigcheck` (GHSA-qm8v-w5qj-32jq), `morglog` (GHSA-v899-gp96-p5rv), `veloq` (GHSA-gccc-9phc-w64p). All `>= 0`, all CWE-506 boilerplate with no per-package IOCs. The mix of utility-sounding names (`stackpaths`, `inspectstack`, `module-relpath`, `sigcheck`) suggests scripted name-generation targeting developer search terms rather than specific typosquats

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`, `uv.lock`) for: `flyteplugins-redis`, `flyteplugins-agento11y`, `flyteplugins-nsight`, `flyteplugins-echo`, `discordnv`, `decoris`, `sap-quarterly-report`, `ekx-report-utils`, `yaml-report-formatter`, `yamlformat-tools`, `yamlformatter-utils`, `mathkitlite`, `@postman-cse/okta-aio-darwin-arm64`, `@hd-team/app-impkg-prod`, `@hd-team/app-dnpkg-beta`, `@hd-team/app-dnpkg-three`, `@hd-team/app-dnpkg-prod`, `@hd-team/app-impkg-test`, `@hd-team/app-dnpkg-ten`, `@hd-team/app-dnpkg-test`, `@hd-team/app-dnpkg-eight`, `hydration-ui-dlx`, `svelte-ui-dlx`, `tailwindcss-3d-animate`, `tailwindcss-form-styles`, `@fleetbo/svro`, `@znan/wabot`, `pushgitquickx`, `stackpaths`, `inspectstack`, `charclass`, `deepjoin`, `module-relpath`, `sigcheck`, `morglog`, `veloq`
2. **For Cluster A (`flyteplugins-*` dependency-confusion probe)**: any organisation that runs Flyte / Union.ai internally MUST audit their pip / uv resolver configuration. Verify `flytekitplugins-*` and `flyteplugins-*` resolve exclusively to the canonical `flyteorg` publisher on the internal index. Pin `--index-url` (not `--extra-index-url`) to the internal mirror for CI runs of Flyte-adjacent code, so pip cannot silently fall through to PyPI. `pip install --dry-run` a Flyte requirements set against a scratch env pointing only at PyPI to see whether the confused version resolves - if 2.6.10 comes back for any of the four flagged names, the attack shape is confirmed against your naming set
3. **For Cluster B (`discordnv` Discord+Roblox DPAPI stealer)**: any Windows user who ran `pip install discordnv==0.8.0` should reset Discord (log out all sessions, rotate token by password change), revoke Roblox sessions, and remove the persistence entry at `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\discordnv`. Because the payload DPAPI-decrypts under the user profile, browser saved passwords for that user are also at risk - a browser password rotation from a clean host is a reasonable defensive move. Block the Discord webhook URL and the Google Apps Script endpoint at egress if you have a proxy
4. **For Cluster C (`decoris` Roblox cookie exfil)**: revoke Roblox sessions from a clean host, uninstall the package, and hunt for prior versions of the same operator's campaign identifier `2026-06-spaysrbdata` in historical pip install logs
5. **For Cluster D (`sap-quarterly-report` + `ekx-report-utils` + `yaml*` DNS exfil family)**: SAP finance / reporting and Python BI shops should verify these did not slip into any BI / finance-team pip install workflow. **DNS-based exfil bypasses HTTP-only egress proxies**: if your egress policy is proxy-only, verify your internal DNS resolvers do not forward externally-resolvable domains for pip-installer-user contexts; or add a DNS-egress-block for these campaign domains once IOCs are published. Because the operator is iterating on `report`/`format`/`formatter`/`utils` themes across multiple publish windows, extend the block-list beyond the exact names to any `*-report-*` / `*format*-utils` / `yaml*format*` install requested by an environment that should never touch these
6. **For Cluster E (`mathkitlite` PROBABLY_PENTEST)**: uninstall from every environment. `pip install --only-binary=:all:` in CI helps against `setup.py` payloads that only trigger from sdist installs
7. **For Cluster G (`@postman-cse/okta-aio-darwin-arm64`)**: any Postman-adjacent org should audit `.npmrc` for a scope-registry pin (`@postman-cse:registry=https://...`) and verify that scope is not resolvable from the public registry - the `okta-aio-darwin-arm64` naming is exactly what a platform-specific internal binary package would look like, and a build box briefly failing over to the public registry would land the malicious version
8. **For Cluster H (`@hd-team/*`)**: treat the entire `@hd-team` scope as poisoned. If any lockfile pins a package under this scope, uninstall the whole scope rather than trying to identify which subset is malicious - all 8 flagged siblings are boilerplate CWE-506 with no per-package IOCs, and the operator can publish more under the same account until the account is locked
9. **For Clusters I, J, K, L, M**: uninstall on hit and rebuild lockfiles. For high-version-count Cluster K takeovers, treat **every historical install** of `@fleetbo/svro` or `@znan/wabot` as compromised, not just the most recent version
10. For all `pip install` runs in CI, prefer `--only-binary=:all:` and pin to source hashes - Clusters A, B, C, D, E all execute at install time via `setup.py` or wheel side-effects. For `flyteplugins-*` shops, also lock the resolver to a single trusted index
11. For all `npm install` runs in CI, run with `--ignore-scripts` where possible - though the `@hd-team` and `hydration-*` clusters have no published IOCs, so scope-blocking at the private mirror is a stronger control
12. Verify none of these packages still resolves via your private mirror - internal caches routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-23fv-6cgr-766g - flyteplugins-redis@2.6.10 (PyPI dependency-confusion setup.py exfil)](https://github.com/advisories/GHSA-23fv-6cgr-766g) - GitHub
- [GHSA-8cpp-43j8-xg7c - flyteplugins-agento11y@2.6.10 (PyPI dependency-confusion setup.py exfil)](https://github.com/advisories/GHSA-8cpp-43j8-xg7c) - GitHub
- [GHSA-33m6-gx9h-9qv5 - flyteplugins-nsight@2.6.10 (PyPI dependency-confusion setup.py exfil)](https://github.com/advisories/GHSA-33m6-gx9h-9qv5) - GitHub
- [GHSA-gcjf-mv7f-ffmf - flyteplugins-echo@2.6.10 (PyPI dependency-confusion setup.py exfil)](https://github.com/advisories/GHSA-gcjf-mv7f-ffmf) - GitHub
- [GHSA-89r4-hq67-cfgq - discordnv@0.8.0 (PyPI Discord token + Roblox cookie DPAPI infostealer)](https://github.com/advisories/GHSA-89r4-hq67-cfgq) - GitHub
- [GHSA-v4c9-8j66-3xg2 - decoris@0.3.0, 0.3.3 (PyPI Roblox cookie exfil, campaign 2026-06-spaysrbdata)](https://github.com/advisories/GHSA-v4c9-8j66-3xg2) - GitHub
- [GHSA-3g4v-hc5w-c37x - sap-quarterly-report@1.0.0 (PyPI DNS exfil, campaign 2026-08-ekx-report-utils)](https://github.com/advisories/GHSA-3g4v-hc5w-c37x) - GitHub
- [GHSA-77v5-hfrm-j4h4 - ekx-report-utils (PyPI DNS exfil, campaign 2026-08-ekx-report-utils)](https://github.com/advisories/GHSA-77v5-hfrm-j4h4) - GitHub
- [GHSA-3q3w-rmgq-cq8x - yaml-report-formatter (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)](https://github.com/advisories/GHSA-3q3w-rmgq-cq8x) - GitHub
- [GHSA-fgh2-58j8-r2cq - yamlformat-tools (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)](https://github.com/advisories/GHSA-fgh2-58j8-r2cq) - GitHub
- [GHSA-rccj-4982-7jfw - yamlformatter-utils (PyPI DNS exfil, campaign 2026-08-ekx-report-utils; added 2026-08-29)](https://github.com/advisories/GHSA-rccj-4982-7jfw) - GitHub
- [GHSA-j3j9-38mp-8cf7 - mathkitlite@0.1.0 (PyPI PROBABLY_PENTEST setup.py exfil)](https://github.com/advisories/GHSA-j3j9-38mp-8cf7) - GitHub
- [GHSA-mjhg-2cvf-w2p4 - @vapi-ai/server-sdk formal advisory (npm; backfills Phantom Gyp 0.11.1, 0.11.2, 1.2.1, 1.2.2)](https://github.com/advisories/GHSA-mjhg-2cvf-w2p4) - GitHub
- [GHSA-2qc4-r3x2-xh47 - @postman-cse/okta-aio-darwin-arm64 (npm internal-namespace probe)](https://github.com/advisories/GHSA-2qc4-r3x2-xh47) - GitHub
- [GHSA-g7cq-7vcf-rp48 - @hd-team/app-impkg-prod (npm CWE-506)](https://github.com/advisories/GHSA-g7cq-7vcf-rp48) - GitHub
- [GHSA-6p53-v557-745c - @hd-team/app-dnpkg-beta (npm CWE-506)](https://github.com/advisories/GHSA-6p53-v557-745c) - GitHub
- [GHSA-qwcv-3958-fhq5 - @hd-team/app-dnpkg-three (npm CWE-506)](https://github.com/advisories/GHSA-qwcv-3958-fhq5) - GitHub
- [GHSA-35w7-82wv-vwxj - @hd-team/app-dnpkg-prod (npm CWE-506)](https://github.com/advisories/GHSA-35w7-82wv-vwxj) - GitHub
- [GHSA-hxxw-mprp-h9w7 - @hd-team/app-impkg-test (npm CWE-506)](https://github.com/advisories/GHSA-hxxw-mprp-h9w7) - GitHub
- [GHSA-q7mf-7f69-7qpr - @hd-team/app-dnpkg-ten (npm CWE-506)](https://github.com/advisories/GHSA-q7mf-7f69-7qpr) - GitHub
- [GHSA-6fm3-xp27-2556 - @hd-team/app-dnpkg-test (npm CWE-506)](https://github.com/advisories/GHSA-6fm3-xp27-2556) - GitHub
- [GHSA-97qc-463w-p2jr - @hd-team/app-dnpkg-eight (npm CWE-506)](https://github.com/advisories/GHSA-97qc-463w-p2jr) - GitHub
- [GHSA-j5x7-qc6j-xwg4 - hydration-ui-dlx (npm hydration-lookalike continuation)](https://github.com/advisories/GHSA-j5x7-qc6j-xwg4) - GitHub
- [GHSA-7qq8-vjh5-hpgw - svelte-ui-dlx (npm hydration-lookalike continuation)](https://github.com/advisories/GHSA-7qq8-vjh5-hpgw) - GitHub
- [GHSA-683p-54mf-9297 - tailwindcss-3d-animate (npm tailwindcss-* typosquat)](https://github.com/advisories/GHSA-683p-54mf-9297) - GitHub
- [GHSA-8wj9-gw6r-6vqh - tailwindcss-form-styles (npm tailwindcss-* typosquat)](https://github.com/advisories/GHSA-8wj9-gw6r-6vqh) - GitHub
- [GHSA-4hrx-gqq5-q956 - @fleetbo/svro (npm ~35-version maintainer takeover)](https://github.com/advisories/GHSA-4hrx-gqq5-q956) - GitHub
- [GHSA-2jxx-8fv2-h8mj - @znan/wabot (npm 80+-version maintainer takeover)](https://github.com/advisories/GHSA-2jxx-8fv2-h8mj) - GitHub
- [GHSA-wx29-h78g-ww4f - pushgitquickx (npm scattered-version takeover)](https://github.com/advisories/GHSA-wx29-h78g-ww4f) - GitHub
- [GHSA-6hcw-m358-fq4q - stackpaths (npm CWE-506)](https://github.com/advisories/GHSA-6hcw-m358-fq4q) - GitHub
- [GHSA-xjx7-pff2-34gp - inspectstack (npm CWE-506)](https://github.com/advisories/GHSA-xjx7-pff2-34gp) - GitHub
- [GHSA-ccgj-rp72-9hvj - charclass (npm CWE-506)](https://github.com/advisories/GHSA-ccgj-rp72-9hvj) - GitHub
- [GHSA-37cw-jw3f-qf4v - deepjoin (npm CWE-506)](https://github.com/advisories/GHSA-37cw-jw3f-qf4v) - GitHub
- [GHSA-pmg4-2q5x-v3x5 - module-relpath (npm CWE-506)](https://github.com/advisories/GHSA-pmg4-2q5x-v3x5) - GitHub
- [GHSA-qm8v-w5qj-32jq - sigcheck (npm CWE-506)](https://github.com/advisories/GHSA-qm8v-w5qj-32jq) - GitHub
- [GHSA-v899-gp96-p5rv - morglog (npm CWE-506)](https://github.com/advisories/GHSA-v899-gp96-p5rv) - GitHub
- [GHSA-gccc-9phc-w64p - veloq (npm CWE-506)](https://github.com/advisories/GHSA-gccc-9phc-w64p) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent pip malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-28-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-28-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).