GitHub Advisory malware sweep, 2 September 2026

The full picture

4 packages 4 versions

• npmeslint-rxjs1.0.1→
• npmeyiouss0.0.0→
• PyPIsyswatch1.0.0→
• npmtwapfetch0.0.0→

What it does if you installed it

• Cluster A - PyPI syswatch Snow Stealer (2026-09-02, 1 package, 1 version): syswatch@1.0.0 (GHSA-mpch-m5gg-4894, campaign 2026-08-envprovision). This is the third package tracked in the ongoing 2026-08-envprovision Snow Stealer campaign after envprovision@1.2.0-1.4.0 (2026-08-24 / 2026-08-26). Payload chain: on Windows only, on import, the package downloads and installs a disguised executable, cleans logs to defeat forensic recovery, and drops Snow Stealer - a heavily obfuscated infostealer with sandbox-evasion routines that (a) enumerates browser saved-password / cookie / autofill stores (Chrome, Edge, Brave, Firefox), (b) modifies cryptocurrency wallet application binaries so subsequent transaction-signing flows leak keys, and (c) implements sandbox-evasion checks (process list, mouse-heuristics, VM registry-tell keys) that force dynamic analysis to actively fight the sample. Persistent installation behaviour: even after pip uninstall syswatch, the dropped Windows binary continues to run. Package name (syswatch = "system watcher") targets operators / SREs who might grep PyPI for a Python system-monitoring library. Any Windows host that ran pip install syswatch since 2026-09-02 needs re-imaging plus wallet-key rotation - the dropper cleans its own logs so post-hoc "we did not find IOCs on disk" is not a clean signal
• Cluster B - npm eslint-rxjs@1.0.1 typosquat (2026-09-02, 1 package, 1 version): eslint-rxjs@1.0.1 (GHSA-45hh-8cg6-r5qp, OpenSSF CWE-506). Typosquats the legitimate eslint-plugin-rxjs (RxJS lint rules maintained by Cartant) - eslint-* shorthand-style names are a well-known npm dep-confusion vector because Node developers routinely omit the -plugin- in imports and configs. OpenSSF Package Analysis flag: "the package communicates with a domain associated with malicious activity". All the highest-fingerprinted eslint config repos (Airbnb, StandardJS, ES bar, RxJS-style guides) are candidate targets. Any Angular / NgRx / RxJS-heavy team that added eslint-rxjs to devDependencies (rather than eslint-plugin-rxjs) should assume dev-workstation compromise
• Cluster C - npm CWE-506 boilerplate takedowns (2026-09-02, 2 packages, no per-package IOCs): eyiouss (GHSA-h2w3-x32h-cpqq) - keyboard-mash naming, generic RCE; twapfetch (GHSA-vfw8-w58v-xv38) - "twap fetch" reads as a DeFi TWAP-price-fetcher helper (targeting DeFi trader / MEV / algo bots). All-versions CWE-506 takedowns with only the standard "any computer that has this package installed or running should be considered fully compromised" advisory boilerplate - defensive value is name-level: any lockfile hit means uninstall

Clean-up steps

1. 1Grep every lockfile (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, Pipfile.lock, poetry.lock, uv.lock) for: syswatch, eslint-rxjs, eyiouss, twapfetch. Uninstall on any hit and rebuild the lockfile against a clean cache
2. 2For Cluster A (syswatch Snow Stealer - third 2026-08-envprovision wave): any Windows host that ran pip install syswatch needs to be re-imaged. Rotate every browser saved-password, cookie, autofill entry, MFA seed, VPN / SSH / cloud-CLI credential on the host - all from a separate clean workstation. If the host held any cryptocurrency wallet, assume funds are at risk: transfer remaining balances to a fresh wallet generated on a known-clean machine before doing anything else. The Snow Stealer family also modifies wallet application binaries so any subsequent wallet install on the same host cannot be trusted - reinstall wallet software from the vendor after re-imaging, never restored from backup. Push the campaign hash lineage (see envprovision 2026-08-24 IOCs) to endpoint EDR blocklists. This is the third package in the same campaign in nine days - expect a fourth brand within days
3. 3For Cluster B (eslint-rxjs typosquat): every package.json and eslint config in the codebase should be audited for "eslint-rxjs" and replaced with "eslint-plugin-rxjs" (the legitimate package). If eslint-rxjs was installed at any point, the dev workstation must be treated as compromised - the malicious variant "communicates with a domain associated with malicious activity" (OpenSSF Package Analysis flag), meaning outbound C2 was in place during the install window. Rotate npm / GitHub / cloud-CLI credentials on the dev workstation
4. 4For Cluster C (CWE-506 boilerplate): any lockfile hit for eyiouss or twapfetch means uninstall and rebuild. twapfetch is a targeted name for DeFi / TWAP / MEV algo trader dev environments - if the affected workstation held any hot wallet or trading-API key, rotate those first
5. 5For all pip install runs in CI, prefer --no-build-isolation + explicit --only-binary where possible. Note: syswatch triggers on import (not install-time build), so --only-binary does not stop it - add syswatch (and any envprovision-family variant) to your registry-mirror deny list
6. 6For all npm install runs in CI, prefer --ignore-scripts - typosquats and dep-confusion pkgs still typically ship postinstall/preinstall hooks even when the primary payload lives in imported code
7. 7Verify none of the enumerated packages still resolves via your private mirror - internal caches (Nexus / Artifactory / Verdaccio / Sonatype / devpi) routinely keep serving yanked tarballs after the public takedown

Sources

• GHSA-mpch-m5gg-4894 - syswatch (PyPI Snow Stealer, 2026-08-envprovision campaign wave 3)github.comGitHub
• GHSA-45hh-8cg6-r5qp - eslint-rxjs (npm typosquat of eslint-plugin-rxjs, malicious domain callback)github.comGitHub
• GHSA-h2w3-x32h-cpqq - eyiouss (npm CWE-506 takedown)github.comGitHub
• GHSA-vfw8-w58v-xv38 - twapfetch (npm CWE-506 takedown, DeFi TWAP-shape name)github.comGitHub
• GitHub Advisory Database - recent npm malware advisoriesgithub.comGitHub
• GitHub Advisory Database - recent PyPI malware advisoriesgithub.comGitHub
• OpenSSF malicious-packages repositorygithub.comOpenSSF